USG110 - Problems applying a saved startup-config file to another USG

USG_User
USG_User Posts: 374  Master Member
5 Answers First Comment Friend Collector Sixth Anniversary
edited April 2021 in Security
Presently we would like to replace our running USG with another USG of the same type. The new USG has been plugged to a separate stand-alone network with only one notebook connected since we cannot put a second USG with the same configuration into the production network as long as the first USG is still running there. Then we've uploaded and applied the latest firmware 4.62 to the new USG. No problem so far. Further we've downloaded the config file (startup-confg.conf) from running USG.

But now we've tried to upload the startup-config to the new USG while it was still not connected to the final production network environment (where the first USG still resides) but only with the One-Notebook-Environment network. The upload process starts but then it fails and USG returns to the original config. The log shows different errors, not reaching networks, not reaching internet servers, etc. But nevertheless it should apply our config. We know that it is not able to rech the final networks as long as it is not placed within its final network environment.

Only when chosen "apply config anyhow with ignoring errors" (or something like that) we were able to upload and apply the config. Is this normal behaviour?

Normally we would expect that a saved config file can be uploaded and applied to an USG also when not in the final network environment. Of course, from the moment where the "new" startup-config has been uploaded and applied, no network connections can be established as long as the "new" USG has been placed in the original network environment again where the config was originally made for. But the upload of config file must not fail, isn't it?

All Replies

  • USG_User
    USG_User Posts: 374  Master Member
    5 Answers First Comment Friend Collector Sixth Anniversary
    Has nobody handed over an existing config to a replacement USG when not yet added to final network environment?
  • Zyxel_Vic
    Zyxel_Vic Posts: 281  Zyxel Employee
    25 Answers First Comment Friend Collector Seventh Anniversary
    Hi @USG_User
    We may need to load this problematic config file to check locally so that we're able to get further information regarding to the error message. Would you share the config file with us in private message?
  • USG_User
    USG_User Posts: 374  Master Member
    5 Answers First Comment Friend Collector Sixth Anniversary
    No problem, I will do it in few seconds
  • USG_User
    USG_User Posts: 374  Master Member
    5 Answers First Comment Friend Collector Sixth Anniversary
    edited February 2021
    We've solved the problem in the following way:
    Due to the fact that an uploaded startup-config.conf will be immediately applied, but the errors let the update process always fail, we have firstly rename the startup-config into e.g. "saved-startup.conf" before uploading it to USG. Such a renamed config will not automatically applied. Then "Apply" this uploaded config. And now the USG offers different options how to proceed with errors. We've chosen "Apply anyway and ignore all errors" (or something like that). After applying, the USG was not longer accessable from the "stand-alone" network, but was directly working after arranging it within the production network again.
    After bringing the replaced USG into operation, we had to uplaod our company logo for the login screen (which is not included within the saved config) and we had to newly create (and distribute) the self-signed certificate for SSL and IPSec VPN.

Security Highlight