VPN to Flex100H is driving me crazy

amateur_netops

I used to use Zywall 110s (primarily) to connect my homes. 6 Locations. As Zywall 110s are no longer updated - it was time to move on. This summer I replaced a Zywall 110 with a Flex 100H. I did not do any further changes when I found out that the 100H Flex does not support forcing a specific VPN tunnel as next hop. Allegedly that will change with a firmware update this October.

But now to my problem: So none of the devices/settings have changed other than the one Flex100H - let's call it Site2 - the tunnels come up - and everything seems fine. I can ping everything from Site1 at Site2 (including the 100H) and vice versa - I can remote desktop into the file server on Site2 - but for some reason http and https connections (on the regular ports) to devices in the LAN on Site2 as well as the device itself don't work. There are "some" packets on port 80 going back and forth - but for all practical purposes it doesn't work.

I can access the web server of my camera system on port 8090. But I can't access any of the cameras directly (can ping them), I can not access the Flex100H and I can't access the Hubitat controller directly.

Zyxel Support claims the issue must be on the (now of course unsupported) Zywall at Site1 (I have the same issue from Site3, Site4, Site5 and Site 6) - which like all other Zywalls have NOT been touched in the Site2 Upgrade.

I find that rather unlikely but nonetheless went through all relevant settings I could think of. I think the issue has to be something on the 100H Flex at Site2 - any thoughts what I could look at?

PeterUK

I have a local VPN site to site Policy-based setup with USG40 to FLEX200H and that fine (mostly other issue) so likely a config problem.

For routing rules its true you can't set incoming to a VPN tunnel but what I have found is by setting to any you can change what the traffic does but I suggest you you set the rule to be strict or at the bottom of the list to not affect other rules.

do you have NAT rule with external IP set to any?

amateur_netops

First of all - thank you for responding.

I do not have a NAT rule with external IP set to any(thing) - and my apologies if this something obvious I should understand - but what would that do?

I assume we are talking about the 100H - it has no configured NAT rules

PeterUK

As you don't have any NAT rules not a problem just that the any on external IP may cause tunnel traffic to follow that rule when you don't want it to.

do you have any routing rule? what are they?

amateur_netops

I have no static routes nor active policy routes on the 100H - I do have a whole bunch of policy routes on all of the old 110s. But since I didn't touch those (and they all make sense to me) I don't expect the issue there.

Zyxel_Kay

Hi @amateur_netops

From our experience, when TCP traffic fails over the VPN tunnel while other protocols, such as ping and RDP, work fine, it may be related to the "Don't Fragment" setting in TCP packets. This issue can occur if the packet size exceeds the VPN packet frame, potentially causing traffic disruptions.

We recommend enabling the "Ignore Don't Fragment" option in the VPN settings on each site, which allows packets to be fragmented and fit within the VPN frame.

Please apply this setting on all of your firewalls and see if it resolves the issue.

However, keep in mind that the USG FLEX H series does not currently support this function. We suggest enabling it on the other sites' firewalls first and then testing the connectivity again.

Let us know how it goes, and feel free to reach out if you need further assistance!

amateur_netops

Hi Kay,

I only tried it on the site I am at - but it did not make a difference from here. I still think it has to do with some security setting or service.

I am currently in 192.168.100.X - the network behind the FlexH is 192.168.111.X - with the device being 111.1

Ping from 100.x to any device in 111.x works

RDP to 111.8 works (only machine that is turned on there)

Windows Fileshare on 111.8 works

http on port 8090 to 111.8 works

http to device (port 80) successfully redirects to https - then dies

http to 111.37 (port 80) results in browser loading the page header (Network Camera) - then dies

http to 111.34 (port 80) - no response (home control system)

http to 111.54 (port 80) which is a password protected web cam results in password (browser) verification coming up - but nothing after authentication

In reverse - accessing a device from 111.x in 100.x works just fine - for example I can access the Zywall at 100.1 from 111.x - same holds true for the hubitat controller in 100.x - can access it from 111.x

PeterUK

Maybe the problem has to do with the FLEX200H on port 80 which should not be a problem but maybe it is so change the FLEX200 HTTP port to 8080

PeterUK

Testing here I did the following setup

VLAN48 > Zywall 110 >tunnel > FLEX200H > LAN138

PC from 192.168.255.66 to 192.168.138.2 port 80> gateway 192.168.255.65 to Zywall 110
tunnel on Zywall 110
local policy 192.168.255.64/28
remote policy 192.168.138.0/28
tunnel on FLEX200H
local policy 192.168.138.0/28
remote policy 192.168.255.64/28
Test PC 192.168.138.2 to test server HTTP

All fine here