Nat rule creation issue on our 500H

Mk88_it
Mk88_it Posts: 68  Ally Member
First Comment Friend Collector Third Anniversary
edited June 23 in USG FLEX H Series

Hello,

Firmware: V1.32(ABZH.0)ITS-0423-250300903

I'm here again... I don't wkonw what excactly is going on our 500H, and sincerly I don't have the time to waste on this....but…

This is the third NAT rule I created that freezed the device and I had to reboot it

To summarize

action made: Create a new NAT rule

What happened after:
Log setting section broken, display "page loading"
Lost connectivity from some vlans
DHCP not working on some vlans
Tried to Switching to secondary device HA with same symptoms

Tried to collect the logs from the gui, aborted after a lot waiting time (more of 10 mins)
Tried to collect the logs from ssh, same as from gui

image.png image.png

Accepted Solution

  • Zyxel_Tina
    Zyxel_Tina Posts: 175  Zyxel Employee
    Zyxel Certified Network Administrator - Security Zyxel Certified Network Administrator - Switch 50 Answers First Comment
    Answer ✓

    For users encountering a similar issue, here is a summary of our findings and a suggested workaround:

    Symptom

    When modifying the NAT rule, certain VLANs are unable to access the internet.

    Root Cause

    1. ARP entry disappears after NAT rule change
      After a NAT rule is modified, we observed that the ARP entry disappears from the firewall. This causes return packets to fail, leading to interrupted connectivity.
    2. Special ISP configuration: PPP bind /32 with a different gateway subnet
      Upon further inspection, we found that the WAN interface is using a /32 PPPoE IP address with a gateway outside of the same subnet. This setup is common with some Italian ISPs, and may require specific handling.

    In such scenarios, we’ve seen unexpected behaviors — such as HA being affected, or the issue only appearing after NAT changes. These are likely due to the current firmware not fully supporting this kind of routing setup. A feature request addressing this was previously submitted, and it may be included in future release. Please kindly follow our Security Gateway News and Release to stay updated on the latest information.

    Workaround

    To ensure return traffic is properly routed, we recommend manually adding the WAN secondary IPs.

    image.png

    Zyxel Tina

All Replies

  • Zyxel_Tina
    Zyxel_Tina Posts: 175  Zyxel Employee
    Zyxel Certified Network Administrator - Security Zyxel Certified Network Administrator - Switch 50 Answers First Comment

    Hi @Mk88_it,

    Could you please provide us with your current configuration and the third NAT rule you intend to apply?

    We'll contact you through private message.

    Zyxel Tina

  • Zyxel_Tina
    Zyxel_Tina Posts: 175  Zyxel Employee
    Zyxel Certified Network Administrator - Security Zyxel Certified Network Administrator - Switch 50 Answers First Comment
    Answer ✓

    For users encountering a similar issue, here is a summary of our findings and a suggested workaround:

    Symptom

    When modifying the NAT rule, certain VLANs are unable to access the internet.

    Root Cause

    1. ARP entry disappears after NAT rule change
      After a NAT rule is modified, we observed that the ARP entry disappears from the firewall. This causes return packets to fail, leading to interrupted connectivity.
    2. Special ISP configuration: PPP bind /32 with a different gateway subnet
      Upon further inspection, we found that the WAN interface is using a /32 PPPoE IP address with a gateway outside of the same subnet. This setup is common with some Italian ISPs, and may require specific handling.

    In such scenarios, we’ve seen unexpected behaviors — such as HA being affected, or the issue only appearing after NAT changes. These are likely due to the current firmware not fully supporting this kind of routing setup. A feature request addressing this was previously submitted, and it may be included in future release. Please kindly follow our Security Gateway News and Release to stay updated on the latest information.

    Workaround

    To ensure return traffic is properly routed, we recommend manually adding the WAN secondary IPs.

    image.png

    Zyxel Tina

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）