Static IP adrress reservation on USGFLEX 200H

AlexandervonW · July 12

Hi there,

on the new 200H, i cannot find any option to make a static IP reservation same as on the former models/software. In firmeware 5.x you could select the network interface, give it an DHCP address range and confige static IUP adresses, which could be out of the DHCP range. Than activate the setting "Enable IP/MAC Binding and DHCP Enforcement" and only those device which MAC adrres is fix configured, could access the network.

I am really lost, where ist that option in the USGFLEX 200H!

Many thnaks for help

Alexander

PeterUK · July 12

Yes you are right you can not set a IP reservation outside the DHCP range for the device to use DHCP and get that IP outside the DHCP range like on current models.

This is likely by design under the new uOS this is something that can be done at some point

Zyxel_Judy · August 13

Hi @PeterUK ,

The issue of being unable to add an entry to the IP/MAC binding list when the name begins with "_" will be addressed in a future firmware update. Please follow the Security Appliance News & Releases section for updates on enhancements and fixes.

Zyxel_Judy · July 12

Hi @AlexandervW ,

With the Firewall H Series, you can reserve a static IP by navigating to Network Status > DHCP Server. Click "Add," enter the necessary information, and click "Save."

AlexandervonW · July 12

Hi Zyxel_Judy,

no, you cannot! I did that, but after for. ex. restart of the device, which has a static ip in the way you wrote, it starts up with a self defined ip adrres (169.x.x.x)!

Remember, the static ip has to be out of the DHCP range!

Thanks for help

Alexander

PeterUK · July 12

Yes you are right you can not set a IP reservation outside the DHCP range for the device to use DHCP and get that IP outside the DHCP range like on current models.

This is likely by design under the new uOS this is something that can be done at some point

AlexandervonW · July 12

Hi PeterUK,

many thanks for your answer. And, this is really stupid by design, because this is the easierst way to bring security to your network!

Anyhow, i have decided to switch back to an ATP500 and the old firmware.

Many thanks for your help

Alexander

Zyxel_Judy · July 15

Hi @AlexandervonW ,

We want to share the steps and results we achieved when reproducing your configuration on the USG FLEX 200H with firmware version 1.20(ABWV.2)C0:

Our ge3 interface is configured with the IP range 192.168.168.33 to 192.168.168.100.
Go to Network Status > DHCP Server, click Add, enter 192.168.168.200 and the MAC address of Device A, and then click Save.
Confirm that Device A obtains the IP address 192.168.168.200.
Restart Device A and wait for it to fully boot up.
Confirm that Device A still retains the IP address 192.168.168.200.

If you performed any steps differently/ different firmware, please let us know. We are here to help verify and confirm the behavior of the USG FLEX 200H.

AlexandervonW · July 15

Hi ZyxeL_judy,

i have the firmware V1.20(ABWV.2) on the 200H. Your setup is right, minor difference is, that i set the DHCP range to f. 192.168.11.200 - 220 and the static ip i choose was 192.168.11.20. After a reboot, in this case a printer, the reservation on the printer was gone…

So, is the "CO" behind your firmware a newer version?

kind regards

Alexander

AlexandervonW · July 15

And, sorry, mind me asking, is the former option "Enable IP/MAC Binding and DHCP Enforcement" now gone? Or is it always active?

Thats for a reply

Alexander

PeterUK · July 15

I see where we are going wrong here @AlexandervonW

see not only must the MAC match so must the name

I have
ge4 LAN 192.168.255.235/26

DHCP 192.168.255.195 pool size 3

if I put in DHCP table

Name _

IP 192.168.255.199

MAC 08:00:27:41:31:6c

The device at MAC 08:00:27:41:31:6c gets no IP

IF I do

Name DESKTOP-FST11TL

IP 192.168.255.199

MAC 08:00:27:41:31:6c

Then the device at MAC 08:00:27:41:31:6c gets the IP by DHCP

Also another problem is you can't use the same name under the interface LAN or if that name is used on another interface LAN

So what I think needs changing is the Name does not need to match only the MAC needs to match for DHCP table to give out the IP for that MAC which is how it is on current models.

Zyxel_Judy · July 16

Hi users,

Our client still obtains the IP address even if the client's name entered in the DHCP table list (e.g., Client_A) is different from the actual client's name (e.g., DESKTOP-JUDY).

To clarify what is happening at your site, we request you to capture a packet and send it to us for analysis. Please follow the steps below:

Go to GUI > Maintenance > Diagnostics > Packet capture
Choose the interface you are testing and set the Host Port as 68
Click Apply button

Click Start icon

Connect client to the USG FLEX 200H network and wait for 3-5 minutes
Click Stops icon
Download the packet file

Zyxel_Judy · July 16

Hi @AlexandervonW ,

So, is the "CO" behind your firmware a newer version?

The V1.20(ABWV.2) and 1.20(ABWV.2)C0 are the same

is the former option "Enable IP/MAC Binding and DHCP Enforcement" now gone?

For the USG FLEX H series, IP/MAC Binding is implemented when you add the IP and MAC address in the DHCP table (no IP/MAC Binding menu). This is different from the IP/MAC Binding flow used in the USG FLEX and ATP series.

Static IP adrress reservation on USGFLEX 200H

Best Answers

All Replies

Categories

Security Help Center