Occasional internet interruptions

e_mano_e

Hi,

a customer complains about internet interruptions.

I'm not sure if it belongs to Zyxel but I delivered a new firewall (USG Flex 100H) in December 2025. Prior to that date the customer used a Zyxel ATP100.

The customer uses the tool "PingPlotter" which shows internet interruptions which are mostly 3 seconds long.

Two days ago there were 22 interruptions within 3 hours.

The question is: Where do these interruptions come from.

The customer uses the following hardware:

1. Router from ISP (Vodafone)
2. Zyxel Firewall USG Flex 100H
3. Zyxel Switch GS1900-24E

PingPlotter runs on a Windows 2022 Server which runs 24/7.
The Server is connected to the Zyxel GS1900 switch.

PingPlotter is useful to show the interruptions with a graphical timeline.

But the main question is: What could be the cause?

Does anyone have any ideas where to narrow down these interruptions?

P.S. The firewall and switch are running with the latest available firmware.

Thanks.

Jens

Zyxel_Melen

Hi @e_mano_e ,

Thank you for reaching out to the Zyxel Community Forum.

To help narrow down the cause of these short, occasional 3-second network interruptions on the USG FLEX 100H, we should approach this by analyzing both the system behavior and capturing logs during the event window.

Here is the diagnostic direction to help investigate:

Diagnostic & Troubleshooting Guidance

1. Verify the Interrupt Type (Crash vs. Interface Interruption):
   1. Since the interruptions are very brief (about 3 seconds) and occur multiple times within a short window, it is highly unlikely to be a full device crash (reboot). A full reboot of the USG FLEX 100H takes significantly longer to load services.
   2. This is likely a brief link flap, gateway check failure, or packet processing delay.
2. Check Port Link Events (WAN/LAN flap):
   1. Check firewall connectivity on Nebula Control Center. Path: Menu > Site-wide > Device > firewall.
   2. Review the event logs on both the USG FLEX 100H and the GS1900-24E switch for any interface up/down events around the exact time PingPlotter logs the drop.
   3. A "Port Up/Down" event on the WAN interface (connected to the Vodafone router) or the LAN interface (connected to the switch) would perfectly match a 3-second recovery.
3. Log Analysis & Diagnostic File Collection:
   1. To pinpoint internal processes or system exceptions during these interruptions, it is essential to trace the system logs during the exact time window of the occurrence.
   2. Please collect a diaginfo file and the configuration file right after observing these drops. This will allow Zyxel Support to inspect internal log entries for any interface, driver, or gateway monitoring activities.
   3. You can refer to this guide on How to collect diaginfo on H-series.

Information Request

To help us investigate further, could you provide the following details?

1. The exact timestamps (including timezone) of a few specific interruptions logged by PingPlotter.
2. The WAN connection type on the USG FLEX 100H (e.g., Static IP, DHCP, or PPPoE) and whether the Vodafone router is configured in Bridge/Modem mode or is acting as a NAT gateway.

Let us know how it goes! Feel free to share the diagnostic files and timestamps with us so we can help you trace the issue.