VPN by Domain Name not working for remote access VPN

PeterUK

USG FLEX 200H V1.20(ABWV.0)ITS-m4447

Domain Name / IP for Domain Name like dnsip11.ddns.net that points to 192.168.255.235 not working when PC on the same LAN but if I use IP or interface it works for downloading the configuration get “policy match error” when using dnsip11.ddns.net when I tested this on V1.10 it I'm sure it was working working

PeterUK

update

I went back to V1.10(ABWV.0)b9s3 and it tested fine for Domain Name then booted to V1.20(ABWV.0)ITS-m4447 and now its fine….so may be a reboot was needed and the settings are not updating in the Flex?

PeterUK

update

It seems the FLEX H does not like Domain Name so use IP or interface but good news is behind NAT when using interface works if you use Domain Name you run into “policy match error”

so if you want to use a DDNS you have to set to Domain Name download the setup Configuration then change back to interface and for Auto Certificate download both Domain Name and interface and copy the .crt over to the Domain Name Configuration.

Zyxel_Jeff

Hello @PeterUK

May we know whether this symptom persists for now? Thanks.

PeterUK

yes you can't use set to  Domain Name give you “policy match error” on the VPN client.

if you quickly set to a Domain Name and click on the client VPN it works but that likely because the change over was not made then next connection “policy match error” only setting to interface is stable

PeterUK

USG FLEX 200H V1.20(ABWV.2)

Just checked this now get no “policy match error” when using Domain Name for VPN IPsec/IKEv2

or not

PeterUK

Ok update on the problem more if Flex is behind NAT without getting a WAN IP

WAN IP > NAT > 192.168.254.10 WAN on flex

When the flex is behind NAT you can't use Domain Name / IP like zyxel-router7.ddns.net or you get “policy match error” on the VPN client but you can get the config when its set to this then set the Incoming Interface to WAN interface or IP 0.0.0.0 for the VPN client to then connect

But if the Flex is not behind NAT getting a WAN IP when Domain Name / IP like zyxel-router7.ddns.net then it works