USG FLEX 200H blocks traffic from LAN1 to LAN2

Options
pieroCastampi
pieroCastampi Posts: 45
First Comment Friend Collector
image  Freshman Member
in USG FLEX H Series
Cattura.JPG 
Good evening. The USG FLEX 200H device is blocking traffic from LAN2 to LAN1, even though the policy is correctly configured. Conversely, traffic from LAN1 to LAN2 works fine. I have placed the rule in position 1 to avoid any potential conflicts, but it still does not work. The USG FLEX is running the latest firmware, v1.40 ABWV.0. I have attached the rule. Thank you.
«1

All Replies

  • PeterUK
    PeterUK Posts: 4,796
    250 Answers 2500 Comments Friend Collector Ninth Anniversary
    image  Guru Member
    Options

    Seems fine here.

    Can you Wireshark one end to ping from another?

  • Zyxel_Melen
    Zyxel_Melen Posts: 5,174
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate
    image  Zyxel Employee
    Options

    Hi @pieroCastampi

    Seems like your LAN2 is a separate zone from LAN1. Please ensure you have set "LAN2 to ZyWall any to any" allow rule first. If not, the firewall will not help to router the traffic.

    Additionally, you may use tracert/traceroute <Windows/Linux> to check where the connection loss.

    Zyxel Melen


  • pieroCastampi
    pieroCastampi Posts: 45
    First Comment Friend Collector
    image  Freshman Member
    Options
     
    Unfortunately, I don’t know how to use Wireshark. In any case, I set up a rule—number 1: LAN2 to ZyWALL, any, any—but nothing changed. I’ve attached the log entry that shows the traffic being blocked. Grazie

    
    
        Cattura.JPG
    

    


    
    
        Cattura.JPG
    

    


    
        
            Cattura.JPG
  • pieroCastampi
    pieroCastampi Posts: 45
    First Comment Friend Collector
    image  Freshman Member
    Options
    Cattura.JPG
  • pieroCastampi
    pieroCastampi Posts: 45
    First Comment Friend Collector
    image  Freshman Member
    Options
     
    Sorry for the mess; it wouldn't let me upload the image of the rule. 192.168.10.2 is LAN2, while 192.168.1.225 is LAN1.
  • Zyxel_Melen
    Zyxel_Melen Posts: 5,174
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate
    image  Zyxel Employee
    Options

    That means the traffic doesn't match any rule of your security policy. Please share your interface configuration with us. I will also send you a private message to get your start-up config file.

    Zyxel Melen


  • PeterUK
    PeterUK Posts: 4,796
    250 Answers 2500 Comments Friend Collector Ninth Anniversary
    image  Guru Member
    Options

    can you try a simple rule from LAN2 to LAN with source and destination to any

  • pieroCastampi
    pieroCastampi Posts: 45
    First Comment Friend Collector
    image  Freshman Member
    Options

    PeterUK Thanks, but I’ve already tried that; it doesn’t work. I have sent the configuration files to Zyxel_melen

  • PeterUK
    PeterUK Posts: 4,796
    250 Answers 2500 Comments Friend Collector Ninth Anniversary
    image  Guru Member
    edited October 20
    Options

    Very odd… I know "override-direct-route" can cause this if you have a routeing from LAN to WAN but that should be off…

    Ok I have one more idea make this top routing rule

    incoming LAN2

    source LAN2 subnet

    destination LAN subnet

    next hop LAN

    SNAT none

    and another rule

    incoming LAN

    source LAN subnet

    destination LAN2 subnet

    next hop LAN2

    SNAT none

    Or maybe wrong set zone?

  • pieroCastampi
    pieroCastampi Posts: 45
    First Comment Friend Collector
    image  Freshman Member
    Options
    https://community.zyxel.com/en/discussion/comment/87738#Comment_87738

    Buonasera, in effetti la zona Lan2 l'ho creata io, di default c'era solo Lan. Avrò commesso un errore nel crearla? Cosa possiamo verificare? Grazie

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）