USG Flex 200H - Traffic from LAN1 to LAN2 issue

einaren

Hi.

I have a Zywall USG Flex 200H.

Scenario I try to achieve is to communicate from one internal LAN to another Internal LAN with Inter-zone traffic.

I have created my own LAN's and added members to these. Called them LAN1 and LAN2. I want to communicate from LAN1 to LAN2 and vice versa. I have two computers with no FW activated. If the two computers is connected on the same Zone PING works. However when I have them on the different Zones I cannot PING or get any traffic through.I have tried to add Policies for this without luck, also tried to "deny" the traffic but even that does not register in the log. Therefore it doesent seem like the ping even tries to go to the other Zone. Also tried to disable the Policies as well.

Computers is on the same subnet with different IP's.

Followed the guide step by step and read throug the manual multilple times but cannot figure this out.Someone have any suggestion to what I missed?

Thanks :)

PeterUK

Testing here it works

Ge4 zone LAN 192.168.255.235/26 test client 192.168.255.193

Ge5 zone LAN2 192.168.138.1/28 test client 192.168.138.2

Policy control

from LAN to LAN2 Ping

from LAN2 to LAN Ping

Maybe you have a switch with ACL?

einaren

Hi.
Same as I tried as well (but with different subnets)
For test purposes I have the computers directly connected to the different Zones, so no ACL switch connected).

Also tried to disable the Policy control.

As far as I understand this should be quite straight forward, therefore I'm not shure what I'm missing.

Or is something wrong with the unit?

PeterUK

Post your interface listing

einaren

https://community.zyxel.com/en/discussion/comment/68272#Comment_68272

Here is a screencapture of my interface and policy window.

PeterUK

I can't seem to find whats wrong with your setup

The only thing left is your clients are not using the gateway to Flex 200H

einaren

https://community.zyxel.com/en/discussion/comment/68295#Comment_68295

I've set them up with the gateways.

My problem exactly, what is wrong 🙉…
I also find it strange that when I set the policies to "deny" insted of "allow", with the "log alarm" on, no event is registerd in the log file. 🤔

I have also tried to reset to "Factory default" and started over a couple of times.
Is there anything wrong with the device you think?

PeterUK

Its a odd one I guess you could Wireshark the PC as it pings make a note of the MAC packet capture on Flex check its MAC and see if that shows anything.

you can also on PC Wireshark arp and run CMD in admin arp -d and check the gateway MAC

einaren

So I solved the problem and it was a mistake from my side. 🙈 It is an registration issue.

When I hooked the device up for the first time I registered the device. Set up a few things and then I had to pospone the job. When I came back to it I continued but could not get it to work. I decided to perform a Factory reset incase I had made a mistake somewhere.

However when I then started the device up again I had no access to internet (dont need it for my test setup) so therefore I did not register it again (I assumed that onetime registration was enough).

That was my problem. I activated the device online again and then everything works fine.

Lesson learned: Register the product to get all the functionality 😉

Thanks for all the help!