USG Flex 200H - Real IP for logged in users

GiuseppeR
GiuseppeR Posts: 308  Master Member
Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Engineer Level 1 - Nebula First Comment Friend Collector
in Security

Hello everyone,

I updated to 1.21 firmware and I cannot identify real IP from which the users are logged in:

immagine.png

As you can see there are 2 users logged in but I cannot see from which IP.

Is there a way to discover that?

Thanks a lot

Accepted Solution

  • Zyxel_Melen
    Zyxel_Melen Posts: 2,595  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate
    Answer ✓

    Hi @GiuseppeR,

    I assume you use the Nebula remote configurator to access your 200H, right?

    image.png

    When you use the remote configurator to establish the remote access address, the Nebula Device creates a reverse SSH (Secure SHell) connection. Therefore, you will see an admin login to the device from 127.0.0.1 in the event log and here.

    If you log in via LAN or WAN, the FLEX H will record the correct source IP address.

    image.png

    Zyxel Melen


All Replies

  • Zyxel_Melen
    Zyxel_Melen Posts: 2,595  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate
    Answer ✓

    Hi @GiuseppeR,

    I assume you use the Nebula remote configurator to access your 200H, right?

    image.png

    When you use the remote configurator to establish the remote access address, the Nebula Device creates a reverse SSH (Secure SHell) connection. Therefore, you will see an admin login to the device from 127.0.0.1 in the event log and here.

    If you log in via LAN or WAN, the FLEX H will record the correct source IP address.

    image.png

    Zyxel Melen


  • GiuseppeR
    GiuseppeR Posts: 308  Master Member
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Engineer Level 1 - Nebula First Comment Friend Collector

    Hello @Zyxel_Melen

    yes, you are right. The firewall is on the field for final tests before being in production.

    Is there any trick to know which "admin" is connecting from which IP also if it is used Nebula remote configurator ?

    I did not find any other areas where to look for logged in users.

    Maybe on Nebula portal?

    Thanks a lot

  • Zyxel_Melen
    Zyxel_Melen Posts: 2,595  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate

    Hi @GiuseppeR,

    Yes, you may check which admin created the remote configurator tunnel in Organization-wide > Change log. But there is currently some issue: the logs are recorded with the wrong admin. We are fixing it and I will update you once the issue is fixed.

    Zyxel Melen


  • Zyxel_Melen
    Zyxel_Melen Posts: 2,595  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate

    Hi @GiuseppeR,

    The log is fixed. You may check who uses remote configurator/remote access to access the USG FLEX H.

    Here is an example of when I use the remote configurator/remote access to create a tunnel. The owner is not "nebula cso" in the screenshot.

    image.png

    Zyxel Melen


  • GiuseppeR
    GiuseppeR Posts: 308  Master Member
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Engineer Level 1 - Nebula First Comment Friend Collector

    Hi @Zyxel_May

    thanks a lot for this update, I'm going to use it 😁

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）