GEO IP update error (firmware V5.37(ABFW.0)

a1601

Hello. Can't update GEO IP database on ATP 200 with firmware V5.37(ABFW.0).
Latest Version: 20230728
Current Version: 20230721

When press "Update" - get error "Geo-IP country database version 20230728 download has failed. (failed) at Mon Jul 31 10:28:49 2023"

Help, please.

PeterUK

make two new rules In routing make them the top rule

incoming ZyWALL

service HTTP/HTTPS

next hop your WAN interface

Zyxel_Jeff

Hi @a1601

Please provide the remote Web-GUI link to us for further checking. We will send a private message to you later, please check your mail in-box. Thanks.

Zyxel_Jeff

Hi @a1601

Could you config Domain Zone Forwarder to the public DNS server 8.8.8.8 and try to update Geo-IP DB again? As Below:

We want to check if the root cause is related to DNS resolution for the Geo-IP DB server URL(cdn.cloud.zyxel.com). Thanks.

a1601

It did not help. Also fails to connect to the ntp server 0.pool.ntp.org (and 2.pool.ntp.org). Access settings, rules, etc. have not changed since the last successful update.

I see some internal error in the logs.

Ping cdn.cloud.zyxel.com from the local network - sucsessful, but fails from the device.

a1601

If for pinging from the device manually select the "correct" (active) interface WAN1 (two WAN are configured, the second is a backup), then pings from the device is successful. By default (without manual selection) ping goes through an inactive interface. I tried to change DNS settings "Qurey via" from "auto" to the active interface WAN1 - it did not help to update the geoip and time.

PeterUK

can you test NTP by IP?

a1601

https://community.zyxel.com/en/discussion/comment/55409#Comment_55409

For extrernal IP - Timeout error.
Internal IP (local NTP server) - sucsessful.

Zyxel_Jeff

Hi @a1601

Once you change to the local NTP server, can you update the Geo-IP database successfully?

https://community.zyxel.com/en/discussion/comment/55410#Comment_55410

a1601

https://community.zyxel.com/en/discussion/comment/55429#Comment_55429

Hi,

No. Still the same error as before.

PeterUK

Do you use SYSTEM_DEFAULT_WAN_TRUNK ?

In routing make this the top rule

incoming ZyWALL

service NTP

next hop your WAN interface

Then test NTP

a1601

https://community.zyxel.com/en/discussion/comment/55464#Comment_55464

No. use "User Configured Trunk" (with two members: wan1 and wan2). For testing switch to System_default.

Created this rule. When in the next hop set WAN1 - NTP check succeeds.