IPSec VPNs not passing traffic after upgrading firmware to latest version.

Options
SINC
SINC Posts: 5  Freshman Member
First Anniversary First Comment
edited June 2023 in Security

We are running multiple IPSec VPN connections using USG110 (firmware version 4.73) and USG40W (firmware version 4.73) routers. We recently went through and performed firmware updates due to vulnerability concerns. After applying the updates we have noticed that VPN traffic is not passing properly. No configuration was changed for the VPNs and after going through logs, we are seeing that there are instances of the traffic being blocked by the default security policy rule. The proper rules are in place IPSec_VPN_Outgoing and IPSec_VPN_to_Device. Traffic appears to be bypassing the security policies and getting blocked by the default rule with the following message "Match default rule, DNAT Packet, DROP". Could the firmware be causing the issue? I've seen no problems with how the VPNs are configured and even went through Zyxel documentation to verify.

All Replies

  • Zyxel_Jeff
    Zyxel_Jeff Posts: 1,104  Zyxel Employee
    First Anniversary 10 Comments Friend Collector First Answer
    Options

    Hi @SINC

    Thanks for your inquiry. What is your current firmware version? Is it V4.73P2 firmware? Could you share a screenshot for the blocked message "Match default rule, DNAT Packet, DROP" with us?

    Besides, please check whether the security policy "WAN_to_Device" allows IKE,NATT,AH,ESP VPN related traffics.

    Thanks.

Security Highlight