Flex 200H - SSLVPN attempts to reconnect every few seconds

Hi @Eric_26,

I understand you're experiencing an issue with your USG FLEX 200H SSL VPN where OpenVPN Connect clients are repeatedly trying to reconnect, while OpenVPN GUI clients are working correctly. This can be a frustrating issue, especially when it was previously functional.

Here are some steps you can take to troubleshoot this:

• Verify SSL VPN Configuration on USG FLEX 200H:

  • Navigate to VPN > SSL VPN on your firewall.
  • Ensure the "Incoming Interface", "Clients will use VPN to access", "Client Network", and "Authentication" relative information is correctly configured.
  • Confirm that the SSL VPN service is added to the service group Default_Allow_WAN_To_ZyWALL and that port 10443 (default for SSL VPN) is allowed from WAN to the firewall.

• Check OpenVPN Client Configuration:

  • Since both OpenVPN Connect and OpenVPN GUI use the same .ovpn file, carefully examine the contents of the .ovpn file.
  • If you are using a split tunnel configuration, ensure that the redirect-gateway directive is removed and the specific routes for your internal networks are correctly defined in the .ovpn file.

• Consider TLS Version Compatibility:

  • Zyxel firewalls allow you to enforce a minimum TLS version for SSL VPN connections. The default is TLS 1.2. If your OpenVPN Connect client is attempting to connect with an unsupported TLS version (e.g., TLS 1.1 or older), the connection will be rejected.
  • Check your USG FLEX 200H's SSL VPN advanced settings (SSL VPN > Advanced Settings) to verify the "Minimum TLS Version" setting.

• Two-Factor Authentication (2FA) Considerations:

  • For OpenVPN clients, if 2FA is enabled, the 2FA authentication page will not automatically open. You will need to manually navigate to http://yourdeviceip:8008 in a web browser after establishing the VPN connection to complete the 2FA. Ensure this is being done for the accounts with 2FA enabled.

To help me further investigate this issue, please provide the following information:

• Screenshots of your SSL VPN configuration from the USG FLEX 200H (VPN > SSL VPN settings).
• The exact error messages displayed in the OpenVPN Connect client logs when it attempts to connect.
• A copy of your .ovpn configuration file (please redact any sensitive information like public IP addresses or pre-shared keys).
• Confirm if the issue occurs with all OpenVPN Connect clients or only specific ones.
• If possible, enable Zyxel Support Access for your Nebula organization. This allows our support team to directly view your cloud environment configuration, significantly shortening troubleshooting time. You can typically find this option under Help > Support Request in the Nebula console, or within the device's local GUI if it's not Nebula-managed. Please provide the Organization or Site name if you enable this.