USG20 Routing Issue during FTP transfer
I'm trying to FTP into a USG20 w/ 3.30(BDQ.9) for config-backup purposes and for some reason the ZyWALL wants to route differently as soon as the data connection begins for transferring a file. The issue is not happening on our USG20-VPN, and I'm curious if perhaps there's a configuration I'm missing somewhere.
Path:
FTP Client VM -> LocalRouter -> USG110 -> VPN Tunnel to another geographical location -> USG20
The control port 21 works fine and traffic flows back and forth along this path during normal FTP comamnds.
However, as soon as you try to retrieve a file and it opens the data connection on the high TCP ports, the endpoint USG20 suddenly starts trying to reply out its LAN interface instead of coming back over the tunnel.
I have the same setup with a USG20-VPN as an endpoint and it works fine. Both Control and Data ports traverse the tunnel.
I've tried to band-aid the problem with very specific policy routes but im not getting anywhere.
Comments
-
Hi @Brandon,
On ZyWALL USG 20, are there any 1:1 NAT rules?
If the answer is yes, the 1:1 NAT function is "forwarding all traffic" to the local server.
In "packet flow explore", the priority of 1-1 SNAT is higher than site to sitesite-to-site VPN when 1:1 NAT is enabled.
To solve this problem on ZyWALL USG 20, please use the following CLI command to reorganize the order of the routing priority.
Router(config)# ip route control-virtual-server-rules activate
Router(config)# write
If it is not the problem, please share the configuration file of USG110 and USG20 with us via private message.
Best regards,
EmilyDon't miss this great chance to upgrade your Nebula org. For free!
0 -
Thanks for the response, unfortunately that doesn't seem to be the issue. I do not have any 1-1 NAT rules. I went ahead and tried to command you posted and I did see where it changed the priority in the packet flow explore but it didn't resolve the issue.
It almost seems like a bug to me. I can't find any configuration set on the zywall that would cause it to route differently based on which port is being used. Just to give more info, this is a passive FTP session.
I've been able to work around the issue for now by just catching those packets coming out the LAN interface and routing them over a different tunnel using MikroTik routers.0 -
Hi @Brandon,
The latest firmware of USG 20 is sent to you via private message.
If the issue is still not resolved and you'd like to find the root cause, please share the configuration file of USG110 and USG20 with us.
Best regards,
EmilyDon't miss this great chance to upgrade your Nebula org. For free!
0 -
0
Categories
- All Categories
- 414 Beta Program
- 2.2K Nebula
- 131 Nebula Ideas
- 91 Nebula Status and Incidents
- 5.4K Security
- 179 USG FLEX H Series
- 258 Security Ideas
- 1.4K Switch
- 71 Switch Ideas
- 1K Wireless
- 36 Wireless Ideas
- 6.2K Consumer Product
- 236 Service & License
- 372 News and Release
- 79 Security Advisories
- 24 Education Center
- 5 [Campaign] Zyxel Network Detective
- 2.9K FAQ
- 34 Documents
- 34 Nebula Monthly Express
- 80 About Community
- 69 Security Highlight