SSL VPN SecuExtender Retirement / Licenses for IPSec SecuExtender needed?

USG_User

Since the SSL VPN SecuExtender Client will be retired soon (or is already retired?), we have to seach for an alternative.

The Windows build-in IKEv2 Client works so far with our USG 700 Flex and could be used, but is not so comfortable for us due to different reasons.

Does Zyxel offers limited IPSec SecuExtender licences for free in order to keep its USG customers connected after retirement of SSL VPN Client? Or are we compelled to pay for such licences from now?

USG_User

Has nobody an idea? or nobody is using the IPSec Client?

Zyxel_Melen

Hi @USG_User,

If you have the SSL VPN SecuExtender license, you can still use it once the OS supports this software. However, we do not offer limited IPSec SecuExtender licenses. You need to purchase a license for the new SecuExtender software if you have new clients who need to use SecuExtender.

USG_User

Hi Melen,

until now we didn't need to purchase a separate SSL VPN SecuExtender Licence because we didn't exceed the number of free licences coming with the USG.

But do we have to pay now, beginning from the first IPSec Secu Extender Licence? This is a deterioration for the customers. One reason for purchasing an USG Flex 700 was also the built-in VPN connectivity without any additional costs. And even for small companies like us with less than 20 employees, it was an advantage, which is now gone.

ScrambledEggs

Hi USG_User

I completely agree, thanks for your post.

Could you please tell me more details about the sentence "…but is not so comfortable for us due to different reasons."

Thanks

Username_is_reserved

If some one here want use a different VPN Client I can recommend the Company "NCP" the build Clients for years now.

USG_User

Hi,

I'm aware of the NCP software products. But you have to pay for licences.

We've paid already a lot for our USG FLEX 700 including annual service upgrade fees. That's why for my understanding a small number of IPSec SecuExtender should be included, but it isn't.

Zyxel_Melen

Hi @USG_User

The licensing structure for the USG FLEX 700 is specifically designed for core security services. SecuExtender, being a specialized VPN software solution, operates as a separate service tier and therefore falls outside the scope of the standard security license package.

I'd like to clarify that USG FLEX series supports Windows built-in IPSec VPN client as part of the base functionality. However, SecuExtender represents our premium VPN solution that reflects the value-added services, like simplified deployment, secure remote access, and enhanced usability. This tiered approach allows us to provide both basic VPN functionality for standard requirements and advanced solutions for organizations requiring more sophisticated VPN management capabilities.

USG_User

Hi Melen,

We are aware of Windows built-in IPSec VPN client solution and have it in operation. Unfortunately the Windows VPN client makes problems when trying to reconnect to net-shares in our local company domain after establishing the VPN tunnel. Windows is always using the same user credentials for VPN login and subsequented network drive connection. But with us, both user credentials are different.

Zyxel_Melen

Hi @USG_User

Thanks for sharing the details. So, the current issue is that the client connects IPSec VPN via Windows built-in VPN, which is connectingsuccessfullyl, it can't connect to the net-shares in your local company domain. May I know the topology is like below?

net-shares —— firewall ==== IPSec VPN ==== remote clients

If so, may I clarify:

1. Does there any security policy blocks IPSec VPN to access the net-shares subnet?
2. Are the accounts of VPN and login user of PC/AD the same account?
3. Have you get a new configuration script and apply again? Please note that the old VPN profile should be deleted before running the new script.

USG_User

Hi Melen,

1. No. We are able to manually connect to our net shares after the IP Sec tunnel is established.
2. Yes. The account credentials of the VPN login and the AD are different for each user.
3. We are using a standard Windows IPSec configuration script in Windows Client for establishing the VPN Tunnel. Net shares are connected manually within Windows file explorer with option "automatic reconnect" and saved AD user credetials. Nevertheless Windows tries to use the IPSec user credentials also for connecting the net shares. If we would use identical user credentials for VPN login and net share login, all would work properly. This has been tested. But we don't wanna use the same user account credentials for both.