Connection issues with SSL VPN and IKEv2 on USG FLEX200H

pieroCastampi

Good evening. To enable remote access to our local network via an SSL VPN client, I configured SecuExtender (version 7.7.50.008) using a file downloaded from our USG FLEX 200H. While it connects successfully on PCs running Windows 10 and Windows Server 2019, it fails to connect on Windows 11.

I also attempted to use IKEv2 by running the `RemoteAccess_Windows_IPSecVPN.bat` file, but that does not work either; although it creates a VPN connection entry within the Windows "VPN" settings, it fails to establish a connection.

Additionally, I tried using OpenVPN with a configuration file downloaded from the USG FLEX. This works on Windows 11, but I have noticed that it fails when using certain internet service providers—for instance, it works at the office, but not at home.

How can I resolve these issues? Grazie

Zyxel_Judy

Hi @pieroCastampi ,

Since you’re seeing issues across three different VPN methods, let’s go through each one separately so we can narrow down the cause.

General information:

• Could you confirm the current firmware version on your USG FLEX 200H?
• What WAN connection type is configured (PPPoE, DHCP, static IP), and are you using DDNS?

We’d also recommend updating to firmware V1.40(ABWV.0)C0, released recently — it includes several VPN-related fixes that may be relevant here. If the issues persist after updating, we’ll continue troubleshooting based on this latest version.

Zyxel_Judy

SSL VPN (SecuExtender) – fails on Windows 11 only:

• Is the Windows 11 machine using a standard Intel/AMD (x86/x64) processor, or an ARM-based processor (for example, Surface Pro X/11/12, or a laptop with a Snapdragon chip)? Please note that SecuExtender currently does not support ARM-based devices, so this is worth ruling out first.
• After rebooting the Windows 11 machine, could you check in Windows Services (services.msc) whether “ZyWALL SecuExtender Helper” (or similarly named service) is running?
• Is there any specific error message when the connection fails, or does the SecuExtender application simply fail to launch/connect?

Zyxel_Judy

IKEv2 – connection entry is created but never establishes:

• Could you try updating to firmware V1.40(ABWV.0)C0 first? This release includes a fix for the Windows IPsec remote access VPN script failing with a “Set-VpnConnectionIPsecConfiguration” error, which may be related to what you’re seeing with the .bat script.
• Does the USG FLEX 200H have a public WAN IP directly, or is it behind NAT (e.g., behind an ISP-provided modem/router)?
• Does the certificate used for IKEv2 have a SAN/CN that matches the exact address (public IP or domain/DDNS hostname) the Windows client is connecting to?

Zyxel_Judy

OpenVPN – works at the office but fails at home:

Since the same OpenVPN setup works at the office but fails at home, this confirms the VPN configuration itself is not the issue.

The problem is most likely with how your home network handles the connection. Zyxel’s SSL VPN on the USG FLEX H series uses port 10443 by default (not a standard port like 443), so we’d like you to check whether your home network is blocking this port.

pieroCastampi

Good morning. I can answer your questions regarding general information; as for the rest, I would prefer to wait until after the firmware update to see if anything changes. I think I can perform the update today. It’s not straightforward, as I have to interrupt user activity—even if only for a few minutes. The current firmware is V1.39(ABWV.0), and the WAN is configured with a static IP. Thank you.

pieroCastampi

https://community.zyxel.com/en/discussion/comment/87664#Comment_87664

Good morning, I have updated the firmware to version V1.40, and now SSL VPN works on Windows 11 clients as well.

pieroCastampi

https://community.zyxel.com/en/discussion/comment/87667#Comment_87667

Good morning. I have verified that the issue occurs when the client is on the same public network as the USG—that is, when the client connects to the internet via the same service provider as the USG. If a different provider is used, it works. Thank you.

pieroCastampi

https://community.zyxel.com/en/discussion/comment/87666#Comment_87666

After updating the firmware to the latest version, I downloaded the .bat file again. It now connects and correctly receives an IP address, but it has no internet access, which prevents me from connecting to the remote network. This is happening on Windows 11, whereas it continues to work fine on Windows 10. I have attached the relevant information. Thank you.

    
        20261020_164337_0002.jpg
    

Zyxel_Judy

Hi @pieroCastampi ,

We tested the IKEv2 full-tunnel setup on our side and couldn’t reproduce the “no internet” issue on Windows 11 — it connected Internet and worked fine. So, this looks specific to your network rather than a general Windows 11/IKEv2 issue.

One thing to check: the VPN assigns client IPs in the 192.168.50.0/24 range as default. If your local network (e.g. home router’s LAN) also uses 192.168.50.x, that overlap could cause this exact symptom.

Could you run ipconfig /all on the Windows 11 PC before connecting and share the IPv4 address/gateway of your active adapter — and let us know if the working Windows 10 test was done on the same network or a different one (e.g. office vs home)?

If there’s an overlap, the fix is usually to change your router’s LAN subnet (e.g. to 192.168.1.x), since the VPN pool is likely shared with other remote users.

pieroCastampi

https://community.zyxel.com/en/discussion/comment/87794#Comment_87794

Good morning. Actually, it doesn't work on Windows 10 either; I may have been mistaken when I previously said it did. Therefore, the issue where IKEv2 connects but provides no internet access affects both Windows 10 and 11. As for the subnets, they are different, so that cannot be the cause of the problem—we use 192.168.8.1. I should also mention—in case it’s helpful—that the .bat file requires a correction, otherwise it throws an error. Specifically, the part referencing the remote local network IP needs to be adjusted: "192.168.1.1" (the remote local network) must be changed to "192.168.1.1/24."
Thank you.