H series router user logins not working

electsystech

We are not able to configure security policies on the H series routers to allow 'user authenticated port forwarding' where a user is required to log into the router to enable a security policy from his 'login ip address'.

Currently the H series routers says 'login denied' when a 'user' tries to log in.

When will this feature be brought back to the USG routers?

Zyxel_Tina

Hi @electsystech,

May I confirm if your intention is to create and add a user account named "etech" on your USG FLEX 50H, so that this user can log in to this 50H device?

(As shown in the first and second images, on the USG FLEX models you could go to CONFIGURATION > Object > User/Group to add a user, and then apply this user to the User field in a Security Policy.)

If that is the case, on the USG FLEX 50H you may create the desired user under User & Authentication > User/Group and then apply it to your policy.

Zyxel_Tina

Hi @electsystech,

May I confirm if your intention is to create and add a user account named "etech" on your USG FLEX 50H, so that this user can log in to this 50H device?

(As shown in the first and second images, on the USG FLEX models you could go to CONFIGURATION > Object > User/Group to add a user, and then apply this user to the User field in a Security Policy.)

If that is the case, on the USG FLEX 50H you may create the desired user under User & Authentication > User/Group and then apply it to your policy.

mjr

Seeing the same issue:

User is created on USG Flex H.

User wants to login to USG Flex H (from WAN) - receives a "login denied"

Best regards,

MJR

PeterUK

Could show the setup on old USG on how this works please?

mjr

comment from zyxel support:

After consulting with our Senior colleagues, we have found out that this feature has been discontinued in the H series firewall (uOS) due to security considerations. You may refer to the release notes for further details if needed. 

PeterUK

So how did this works you login to the USG which a firewall rule to allow RDP by user from the IP you logged into from?

mjr

with the Usg flex (pre H) it was possible to configure a security policy/firewall rule/NAT (access LAN from WAN), which was bound to a specific user/user group. the user had to logon to the firewall (via webinterface), authenticate and afterwards the connection was allowed.