EricNepean2

Interesting, but I think the scope is too narrow. It should allow updates to all Security and UTM features {Antivirus, AntiSpam, Content Fiter, App Patrol, IDP} as well as alllowing for the device firmware update.

Port 5 on my USG40W is not being used for anything. I have designated this as my rescue port. Could also be dsignated as the "admin" port. I gave this port its own zone; the DHCP pool for this port has a unique range. My security policies are such that this zone is not connected to the WAN, nor to other LAN Ports, and…

The operational issue I still see with 2FA is that if your WAN connection is down, 2FA will not work, preventing admin access to the Zyxel device. Now it becomes more difficult to discover why your network is down.