FlexH 50 - very slow first sync

Options
GiuseppeR
GiuseppeR Posts: 581 image  Master Member
Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Engineer Level 1 - Nebula First Comment Friend Collector
in USG FLEX H Series

Hello everyone,

I'm setting new firewalls from H Series and I'm waiting for a lot of time that they sync with Nebula.

I see this:

immagine.png

Is it possible to make the sync as quick as possible?

I'm waiting for about 30 minutes instead of 3 mins.

Also online it is saying that the firewall it NOT up to date:

immagine.png
«1

All Replies

  • PeterUK
    PeterUK Posts: 4,342 image  Guru Member
    250 Answers 2500 Comments Friend Collector Eighth Anniversary
    edited December 2025

    If you click on the nebula status in System Information then click test many times to see TCP ping successful many times or if it fails some times.

    You could also setup to use another DNS if needed

  • Zyxel_Tina
    Zyxel_Tina Posts: 529 image  Zyxel Employee
    Zyxel Certified Network Administrator - Security Zyxel Certified Network Administrator - Switch 100 Answers 500 Comments

    Hi @GiuseppeR,

    To investigate further, could you please enable the Zyxel Support Access and provide us your org and site name?

    Zyxel Tina

  • GiuseppeR
    GiuseppeR Posts: 581 image  Master Member
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Engineer Level 1 - Nebula First Comment Friend Collector

    Hi @Zyxel_Tina

    you have a PM with that infos regarding that new ORG with 3x Flex50H.

    Have a nice day

  • GiuseppeR
    GiuseppeR Posts: 581 image  Master Member
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Engineer Level 1 - Nebula First Comment Friend Collector

    Hi @PeterUK

    I saw "Connected" to Nebula via local UI on my firewalls, so I expected them to sync faster.

  • PeterUK
    PeterUK Posts: 4,342 image  Guru Member
    250 Answers 2500 Comments Friend Collector Eighth Anniversary

    Yes is says connected but the way that done is under one session that had been allowed by the server but new sessions may not be allowed correctly.

  • Zyxel_Tina
    Zyxel_Tina Posts: 529 image  Zyxel Employee
    Zyxel Certified Network Administrator - Security Zyxel Certified Network Administrator - Switch 100 Answers 500 Comments

    Hi @GiuseppeR,

    Thank you for providing the information!

    The "not up to date" status can occur when a configuration setting exists on one side but is restricted or unsupported on the other end. This prevents successful config synchronization and can cause the device to remain stuck in the "Applying Cloud Configuration" state.

    After checking your sites, we found the status is now up to date. To investigate further, could you please confirm if any configuration changes were made while the device was applying the cloud configuration? In addition, could you provide the approximate times when you saw the "not up to date" status and when it returned to "up to date"? This information will help us check the logs and determine what happened during the issue.

    Zyxel Tina

  • GiuseppeR
    GiuseppeR Posts: 581 image  Master Member
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Engineer Level 1 - Nebula First Comment Friend Collector

    Hi @Zyxel_Tina

    I unboxed all of those 3x FlexH 50, adding them to Nebula creating sites (including an AP for each site) of my ORG and then I saw no FWs online so I was forced to go on 192.168.168.1 to set them up.

    At the beginning no FW was linked to internet or switched on, I was testing the possibility to deploy them without entering the webUI like you can do with other Nebula stuff, a sort of "plug and play" remotely... I saw that it is impossible to do also with newest FlexH series FWs.

    So I entered the web UI of each FW with the password on the label and setup the minimum parameters to have those firewalls online, I saw there the alert to wait 3-5 minutes on local UI. I went on Nebula to setup PPPoE and LAN and other things like WiFi profile to avoid problems mixing local and remote configs.

    To have the Nebula config synced locally I had to wait from 15 to about 30 mins (considering the differences among 3 configured sites) and I think that this value is really different from "3 mins" written on local UI. 3 mins should be perfect. 😎

  • Zyxel_Tina
    Zyxel_Tina Posts: 529 image  Zyxel Employee
    Zyxel Certified Network Administrator - Security Zyxel Certified Network Administrator - Switch 100 Answers 500 Comments

    Hi @GiuseppeR,

    Regarding the slow synchronization you're experiencing, we would like to clarify that NCC operates with a specific fail-and-retry mechanism. If configuration changes are made during the sync process, it can trigger a failure. When this happens, the system waits for the next scheduled synchronization round, causing the delay.

    To ensure a smoother experience, we recommend allowing the device to complete its initial sync fully before making further configuration changes.

    We appreciate your understanding :)

    Zyxel Tina

  • GiuseppeR
    GiuseppeR Posts: 581 image  Master Member
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Engineer Level 1 - Nebula First Comment Friend Collector

    Hi @Zyxel_Tina

    I understood. Which is the expected time for fail-and-retry process?

  • Zyxel_Tina
    Zyxel_Tina Posts: 529 image  Zyxel Employee
    Zyxel Certified Network Administrator - Security Zyxel Certified Network Administrator - Switch 100 Answers 500 Comments

    Hi @GiuseppeR,

    Regarding your question, the NCC system is scheduled to synchronize every 15 minutes.

    If a configuration sync fails or is not fully completed, the system will automatically trigger a retry in the next 15-minute cycle. Therefore, the expected interval for the fail-and-retry process is 15 minutes.

    We appreciate your understanding :)

    Zyxel Tina

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）