Flex 200H - SSLVPN attempts to reconnect every few seconds

Options
2»

All Replies

  • Eric_26
    Eric_26 Posts: 11 image  Freshman Member
    First Comment Friend Collector
    https://community.zyxel.com/en/discussion/comment/82771#Comment_82771

    Hallo PeterUK

    Sorry for the delay, my personal anti-malware did not work as it should so I had to stay in horizontal recovery-mode for a few days.
    I did the manual editing of the ovpn-file, re-imported it and tried the connection. Unfortunately no success, the problem remains like I described before.

    Greetings
    Eric

  • Eric_26
    Eric_26 Posts: 11 image  Freshman Member
    First Comment Friend Collector

    Hello Zyxel_Melen

    Also sorry for the late response.
    First off all, "Remote Access with Strongswan does not work", refers to another firewall. There I had problems with firmware v1.36 and had to revert to 1.35. PeterUK wrote something to that problem as well, but that has to wait (lost to much time being sick). Until this is resolved, any firmware update on the 200H has to wait. I do not require multiples connection-problems.

    To the OpenVPN SSL VPN Connection:
    Question: If I setup one user-account with 2FA enabled, as described by you, does this mean ALL user-accounts have to use this 2FA setup as well? In other words, either all use it oder none at all?

    Eric

  • PeterUK
    PeterUK Posts: 4,452 image  Guru Member
    250 Answers 2500 Comments Friend Collector Eighth Anniversary
    edited January 20

    Not sure how you not got Strongswan to work all you got to do is import a file.

    Try Remote Access again with the following settings

    Type: IP address
    IP address 0.0.0.0
    NAT traversal custom IP or domain name
    Add you WAN IP or domain name that points to your WAN

    Then disable and enable Remote Access and download the Script and import that should work if firewall from WAN to Zywall for VPN traffic is allowed.

    Yes currently when 2FA is enabled for the given VPN type all users have to do 2FA.

  • Zyxel_Melen
    Zyxel_Melen Posts: 4,683 image  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate
    edited January 21 Answer ✓
    https://community.zyxel.com/en/discussion/comment/82980#Comment_82980

    Hi @Eric_26

    No worry, please take your time and hope you'll get better soon.

    About the 2FA part: Yes, once the Two-factor Authentication > VPN access enables, all of users requires to enable Two-factor Authentication for this user.

    Zyxel Melen


  • Eric_26
    Eric_26 Posts: 11 image  Freshman Member
    First Comment Friend Collector

    @Zyxel_Melen

    Thanks, I am fine again (ok, more or less…).
    And again, thanks, I was not aware of this requirement. We want to implement 2FA more and more but in this testcase with the new Flex 200H Firewall, I fell on my face with it.

  • Eric_26
    Eric_26 Posts: 11 image  Freshman Member
    First Comment Friend Collector
    https://community.zyxel.com/en/discussion/comment/82982#Comment_82982

    Hello PeterUK

    Strongswan setup looks like this:
    Remote Access VPN
    Interface: ge1 (WAN)
    NAT Traversal : empty
    Zone: IPSec_VPN
    Certificate: manuel, selfsigned
    Full Tunnel
    Client Network: 192.168.50.0/24, Zywall as DNS
    User: group vpnusers
    Rest: default

    No additional routing configured.
    The sswan file was manually modified:
    "name" - here I defined a decent name for the user to recognise his company
    "addr" - replaced with dyndns hostname
    "id" - replaced with dyndns hostname

    Imported, username/password added and it worked on a v1.35 (ABXF.2) and as well on my private Flex 50H. This setup works on the customers network with his public ip terminated on the firewall (modem in bridge modus). My private network reachable over portforwarding (VPN ports only) on the home-router to the Flex 50H.

    Greetings
    Eric

  • adbro
    adbro Posts: 2 image  Freshman Member
    First Comment

    Hi

    I have the same issue. Melen is correct that enabling two factor authentication gets over the problem. However In my case I do not want some users to have 2FA. How do I get around this problem?

    Regards Paul

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）