GEO IP update error (firmware V5.37(ABFW.0)

Options
a1601
a1601 Posts: 30  Freshman Member
First Anniversary 10 Comments Friend Collector
in Security

Hello. Can't update GEO IP database on ATP 200 with firmware V5.37(ABFW.0).
Latest Version: 20230728
Current Version: 20230721

When press "Update" - get error "Geo-IP country database version 20230728 download has failed. (failed) at Mon Jul 31 10:28:49 2023"

Help, please.

GEOIP1.jpg
GEOIP2.jpg

Accepted Solution

  • PeterUK
    PeterUK Posts: 2,794  Guru Member
    First Anniversary 10 Comments Friend Collector First Answer
    Answer ✓
    Options

    make two new rules In routing make them the top rule

    incoming ZyWALL

    service HTTP/HTTPS

    next hop your WAN interface

«1

All Replies

  • Zyxel_Jeff
    Zyxel_Jeff Posts: 1,082  Zyxel Employee
    First Anniversary 10 Comments Friend Collector First Answer
    Options

    Hi @a1601

    Please provide the remote Web-GUI link to us for further checking. We will send a private message to you later, please check your mail in-box. Thanks.

  • Zyxel_Jeff
    Zyxel_Jeff Posts: 1,082  Zyxel Employee
    First Anniversary 10 Comments Friend Collector First Answer
    Options

    Hi @a1601

    Could you config Domain Zone Forwarder to the public DNS server 8.8.8.8 and try to update Geo-IP DB again? As Below:

    change DNS zone forwarder.png

    We want to check if the root cause is related to DNS resolution for the Geo-IP DB server URL(cdn.cloud.zyxel.com). Thanks.

  • a1601
    a1601 Posts: 30  Freshman Member
    First Anniversary 10 Comments Friend Collector
    edited August 2023
    Options

    It did not help. Also fails to connect to the ntp server 0.pool.ntp.org (and 2.pool.ntp.org). Access settings, rules, etc. have not changed since the last successful update.

    zdns.jpg
    zntp.jpg

    I see some internal error in the logs.

    zerr.jpg

    Ping cdn.cloud.zyxel.com from the local network - sucsessful, but fails from the device.

  • a1601
    a1601 Posts: 30  Freshman Member
    First Anniversary 10 Comments Friend Collector
    edited August 2023
    Options

    If for pinging from the device manually select the "correct" (active) interface WAN1 (two WAN are configured, the second is a backup), then pings from the device is successful. By default (without manual selection) ping goes through an inactive interface. I tried to change DNS settings "Qurey via" from "auto" to the active interface WAN1 - it did not help to update the geoip and time.

  • PeterUK
    PeterUK Posts: 2,794  Guru Member
    First Anniversary 10 Comments Friend Collector First Answer
    Options

    can you test NTP by IP?

  • a1601
    a1601 Posts: 30  Freshman Member
    First Anniversary 10 Comments Friend Collector
    Options
    https://community.zyxel.com/en/discussion/comment/55409#Comment_55409

    For extrernal IP - Timeout error.
    Internal IP (local NTP server) - sucsessful.

  • Zyxel_Jeff
    Zyxel_Jeff Posts: 1,082  Zyxel Employee
    First Anniversary 10 Comments Friend Collector First Answer
    Options

    Hi @a1601

    Once you change to the local NTP server, can you update the Geo-IP database successfully?

    https://community.zyxel.com/en/discussion/comment/55410#Comment_55410

  • a1601
    a1601 Posts: 30  Freshman Member
    First Anniversary 10 Comments Friend Collector
    Options
    https://community.zyxel.com/en/discussion/comment/55429#Comment_55429

    Hi,

    No. Still the same error as before.

  • PeterUK
    PeterUK Posts: 2,794  Guru Member
    First Anniversary 10 Comments Friend Collector First Answer
    Options

    Do you use SYSTEM_DEFAULT_WAN_TRUNK ?

    In routing make this the top rule

    incoming ZyWALL

    service NTP

    next hop your WAN interface

    Then test NTP

  • a1601
    a1601 Posts: 30  Freshman Member
    First Anniversary 10 Comments Friend Collector
    Options
    https://community.zyxel.com/en/discussion/comment/55464#Comment_55464

    No. use "User Configured Trunk" (with two members: wan1 and wan2). For testing switch to System_default.

    Created this rule. When in the next hop set WAN1 - NTP check succeeds.

Categories

Security Highlight


Read more

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）