UDP port 4500 sometime get blocked when allowed over bridge

PeterUK

VPN300

V5.37(ABFC.2)

This dose not happen all the but have confirmed it by packet capture on VPN300 I see UDP 4500 on LAG0 and not out LAG1 over the bridge when it is allowed fix is to reboot the VPN300

Here is a cut down of the network setup

Zyxel_Jeff

Dear @PeterUK

We observed VPN disconnection log messages. Regarding the topology, could you please provide details on the VPN300's site-to-site VPN connection with which destination device? Thanks.

Nicholas185

It seems there is an intermittent issue on the VPN300 with firmware version V5.37(ABFC.2). Confirming through packet capture, UDP 4500 is observed on LAG0 but not on LAG1 over the bridge, and this problem is resolved by rebooting the VPN300. If this issue persists, it may require further investigation or contacting the device's support for potential firmware updates or resolutions. Sports accessories and equipment

PeterUK

Yes that is correct @Nicholas185

So the connection goes like this for site to site:

VPN300 Ge4 DHCP to > Nighthawk M2 Mobile Router EE ISP in IP passthrough > in on my virgin media throughout VPN300 bridge setup > to FLEX200 DHCP WAN on SFP

the VPN300 as a bridge allows all traffic its reason is to BWM for all USG downstream from it

Zyxel_Jeff

Hi @PeterUK

OK, thank you for your update. Let's check it.

PeterUK

10 days uptime it happened again

Would the team like to check the LAG0 in LAG1 out as to why port 4500 is not being forwarded as I will leave it in this state should it not fix its self for checking thanks.

Small update test I did but the problem is ongoing I did a UDP scan for 4500 https://www.ipvoid.com/udp-port-scan/

and that goes through so its very odd why the true VPN connection for 4500 is being blocked

Zyxel_Jeff

Hello Peter,

May we know if there have been any ADP blocked messages, such as UDP flooding or others?

john856

Get a font style you like today from Dafont to make your designs better. Da Font has many fonts you can get for free.

PeterUK

https://community.zyxel.com/en/discussion/comment/63253#Comment_63253

I don't see any ADP blocked messages and I tried disabling ADP but didn't fix the issue

Currently its in a loop at some point my EE 4G will change IP out CGNAT so that might cause it to start working?

capture before getting to LAG0

PeterUK

shows in session view

PeterUK

and my 4G IP changed to 31.94.60.122 with the VPN up and running fine.

some type of problem that the LAG bridge stops forwarding port 4500