Routing rule SNAT Address set outgoing-interface to use Primary IP

PeterUK

This issue also happens on other things like VPN on set interface

For Interfaces that have Secondary IP and Routing rule SNAT Address set outgoing-interface it picks whatever Primary IP or any Secondary IP in the ZLD it is for SNAT outgoing-interface always Primary unless set otherwise.

The only workaround is to always set SNAT.

Zyxel_Luna

Hi @PeterUK,

Thank you for sharing this information.

Before we proceed, could you please help clarify the following two points?

1.Which product series are you referring to?

The post explicitly refers to this case occurring "in the ZLD," but the term "Secondary IP" it uses is actually the naming convention used in the H series (uOS) interface configuration. Therefore, we would like to double-check with you which product series you are currently referring to.

2. Is this post purely for informational sharing, or are you proposing a feature enhancement/feedback for a specific series?
For example, regarding the SNAT selection logic in Routing Rules: what criteria would you suggest the system use to determine whether to apply the Primary IP or a Secondary IP when "SNAT Address" is set to "outgoing-interface"?

PeterUK

Hi Luna

So this feed back is for the why H series (uOS) works which the way "SNAT Address" is set to "outgoing-interface" when there are Secondary IP it does not pick Primary IP like it does in ZLD this can cause problems as to what "SNAT Address" is going to be used and if "SNAT Address" needs to be other then the user can still set a IP manually for "SNAT Address"

Zyxel_Luna

Hi @PeterUK,

Regarding the issue where the source IP randomly picks either the primary IP or a secondary IP when "SNAT Address" is set to "outgoing-interface" on a WAN interface configured with both primary and secondary IPs:

We have received similar feedback from other users, and we plan to fix this in an upcoming release by prioritizing the primary IP for outgoing traffic.

Since this is classified as a issue rather than a feature request, I will move this post to the [USG FLEX H Series] section.

If you need a datecode firmware that addresses this issue, please send me a PM with your device model and current firmware version — whether that's the latest official release or a datecode build. I'll provide the firmware for you to test as soon as possible.

Thank you again for your continued support of Zyxel!