Bug report (availability/stability) on Flex 500: network range overlap mismatch

stray
stray Posts: 3  Freshman Member
First Comment
in Security

The following steps produce a faulty configuration file, that however runs sucessfully. Only after a reboot the faulty file is rolled back (which can be many months later, making it very hard to find what the issue was in the first place):

  • Have a subnet, i.e. 192.168.2.1/24 configured on interface LAN2
  • Disable the subnet
  • Create a virtual interface on LAN1 with the same configuration 192.168.2.1/24
  • The interface does not give any warning, and the virtual interface works as expected
  • REBOOT
  • The configuration is rolled back, because at boot time, the disabled LAN2 "conflicts" with the virtual interface. Thus, all other changes since the last reboot are lost.

Expected behaviour: Either warn about the perceived conflict in the GUI when it is introduced, or don't treat address conflicts with a disabled interface as an error.

Accepted Solution

  • Zyxel_Judy
    Zyxel_Judy Posts: 2,045  Zyxel Employee
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security Zyxel Certified Network Engineer Level 1 - Nebula
    Answer ✓

    Hi @stray ,

    We have confirmed the issue with your device, which occurs under a specific configuration. This will be addressed in the next official firmware release.

All Replies

  • Zyxel_Judy
    Zyxel_Judy Posts: 2,045  Zyxel Employee
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security Zyxel Certified Network Engineer Level 1 - Nebula

    Hi @stray ,

    We followed your steps to reproduce the issue but were unable to do so.

    The GUI displays a warning message: "This is a duplicate IP address", and the virtual interface with 192.168.2.1/24 couldn't be added.

    image.png

    Please confirm whether your USG FLEX 500 is running firmware version 5.39(ABUJ1)C0.

  • stray
    stray Posts: 3  Freshman Member
    First Comment

    I am using V5.39(ABUJ.1) / 2024-11-16 03:16:37.

    I just tried again (with a different subnet, since I need 192.168.2.1 productive), with disabled lan2 on subnet 192.168.99.1/24 it let me create the same network range on lan1:4, as seen on the screenshot:

    image.png

    Your screenshot is obviously the expected behaviour, but this doesn't happen on my interface. Browser is Chrome 134.0.6998.35.

  • Zyxel_Judy
    Zyxel_Judy Posts: 2,045  Zyxel Employee
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security Zyxel Certified Network Engineer Level 1 - Nebula
    edited March 11

    Hi @stray ,

    To proceed with your case, we need access to your USG FLEX 500. Please follow the article to configure the WAN access and share information with us through a private message by clicking on "My account" and then selecting "Message."

    How to allow HTTPS Web GUI Access from WAN? (USG/USG FLEX/ATP/VPN) — Zyxel Community

  • Zyxel_Judy
    Zyxel_Judy Posts: 2,045  Zyxel Employee
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security Zyxel Certified Network Engineer Level 1 - Nebula
    Answer ✓

    Hi @stray ,

    We have confirmed the issue with your device, which occurs under a specific configuration. This will be addressed in the next official firmware release.

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）