GEO IP update error (firmware V5.37(ABFW.0)

a1601
a1601 Posts: 30  Freshman Member
First Comment Friend Collector First Anniversary
in Security

Hello. Can't update GEO IP database on ATP 200 with firmware V5.37(ABFW.0).
Latest Version: 20230728
Current Version: 20230721

When press "Update" - get error "Geo-IP country database version 20230728 download has failed. (failed) at Mon Jul 31 10:28:49 2023"

Help, please.

GEOIP1.jpg
GEOIP2.jpg

Accepted Solution

  • PeterUK
    PeterUK Posts: 3,387  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary
    Answer ✓

    make two new rules In routing make them the top rule

    incoming ZyWALL

    service HTTP/HTTPS

    next hop your WAN interface

«1

All Replies

  • Zyxel_Jeff
    Zyxel_Jeff Posts: 1,230  Zyxel Employee
    100 Answers 500 Comments Friend Collector Fourth Anniversary

    Hi @a1601

    Please provide the remote Web-GUI link to us for further checking. We will send a private message to you later, please check your mail in-box. Thanks.


    241015_Speak-up,-Win-WiFi-7_Community-CSO-signature_1920x200.jpg

    Share your feedback through our survey, make your voice heard, and win a WiFi 7 AP! https://bit.ly/2024_Survey_Community

  • Zyxel_Jeff
    Zyxel_Jeff Posts: 1,230  Zyxel Employee
    100 Answers 500 Comments Friend Collector Fourth Anniversary

    Hi @a1601

    Could you config Domain Zone Forwarder to the public DNS server 8.8.8.8 and try to update Geo-IP DB again? As Below:

    change DNS zone forwarder.png

    We want to check if the root cause is related to DNS resolution for the Geo-IP DB server URL(cdn.cloud.zyxel.com). Thanks.


    241015_Speak-up,-Win-WiFi-7_Community-CSO-signature_1920x200.jpg

    Share your feedback through our survey, make your voice heard, and win a WiFi 7 AP! https://bit.ly/2024_Survey_Community

  • a1601
    a1601 Posts: 30  Freshman Member
    First Comment Friend Collector First Anniversary
    edited August 2023

    It did not help. Also fails to connect to the ntp server 0.pool.ntp.org (and 2.pool.ntp.org). Access settings, rules, etc. have not changed since the last successful update.

    zdns.jpg
    zntp.jpg

    I see some internal error in the logs.

    zerr.jpg

    Ping cdn.cloud.zyxel.com from the local network - sucsessful, but fails from the device.

  • a1601
    a1601 Posts: 30  Freshman Member
    First Comment Friend Collector First Anniversary
    edited August 2023

    If for pinging from the device manually select the "correct" (active) interface WAN1 (two WAN are configured, the second is a backup), then pings from the device is successful. By default (without manual selection) ping goes through an inactive interface. I tried to change DNS settings "Qurey via" from "auto" to the active interface WAN1 - it did not help to update the geoip and time.

  • PeterUK
    PeterUK Posts: 3,387  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary

    can you test NTP by IP?

  • a1601
    a1601 Posts: 30  Freshman Member
    First Comment Friend Collector First Anniversary
    https://community.zyxel.com/en/discussion/comment/55409#Comment_55409

    For extrernal IP - Timeout error.
    Internal IP (local NTP server) - sucsessful.

  • Zyxel_Jeff
    Zyxel_Jeff Posts: 1,230  Zyxel Employee
    100 Answers 500 Comments Friend Collector Fourth Anniversary

    Hi @a1601

    Once you change to the local NTP server, can you update the Geo-IP database successfully?

    https://community.zyxel.com/en/discussion/comment/55410#Comment_55410


    241015_Speak-up,-Win-WiFi-7_Community-CSO-signature_1920x200.jpg

    Share your feedback through our survey, make your voice heard, and win a WiFi 7 AP! https://bit.ly/2024_Survey_Community

  • a1601
    a1601 Posts: 30  Freshman Member
    First Comment Friend Collector First Anniversary
    https://community.zyxel.com/en/discussion/comment/55429#Comment_55429

    Hi,

    No. Still the same error as before.

  • PeterUK
    PeterUK Posts: 3,387  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary

    Do you use SYSTEM_DEFAULT_WAN_TRUNK ?

    In routing make this the top rule

    incoming ZyWALL

    service NTP

    next hop your WAN interface

    Then test NTP

  • a1601
    a1601 Posts: 30  Freshman Member
    First Comment Friend Collector First Anniversary
    https://community.zyxel.com/en/discussion/comment/55464#Comment_55464

    No. use "User Configured Trunk" (with two members: wan1 and wan2). For testing switch to System_default.

    Created this rule. When in the next hop set WAN1 - NTP check succeeds.

Categories

Security Highlight


Read more

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）