stephan  Freshman Member

Okay these seem to have been transient issues. I restarted the USSG60 once again between my last post and now (it was restarted before my last post) without any configuration changes and it works now. Key handshake runs on USP4500 now as expected. All other stages of the VPN work. I think my USG 60 at the branch office had…

Talked to ISP: They do not block ESP. Unfortunately, it seems that the statement that UDP 4500 is used when one part is behind NAT is also not correct. I put the branch USG60 behind a local NAT and the firewalls still try to connect via UDP:500 to exchange keys. And I am observing very strange behavior. On the USG200 (main…

I'll talk more in detail with the ISP tomorrow. Especially also about why this was changed when we only changed our IP. Because the tunnel did work before the change.

"If both sides have the WAN IP you be using protocol 50 not UDP port 4500 so it might be your ISP is blocking this." ISP can't dig into this during the weekend. On the one branch that can connect, the FW has the WAN port set to an internal IP (which I guess is why VPN Tunnel there still works) and the IKE logs show key…

"You can find the status of a routeing rule by looking at the rule list on the left with a light bulb icon normally its yellow. " All rules are yellow, none are red. Is that what you mean. "If both sides have the WAN IP you be using protocol 50 not UDP port 4500 so it might be your ISP is blocking this." That might…

Yes, both USGs have WAN IPs on the WAN Interfaces. Neither of them are behind a NAT. Where can I find if a routing rule has a red status? There is only one routing rule applicable to this VPN connection on the USG60 side, and it looks correct. This is the setting there: MOL_ALL_LANS just contains all the subnets on the MOL…

I tried this, no change. The hub had the IP change. Connectivity Check was never enabled on any of our VPN connections so far, afaik. "Are you sure that the "new connection" receives both ports UDP 500 and 4500?" No, but I strongly suspect so, because the other spoke (another USG200 at a 2nd branch, see initial post at the…

For everybodies information. With the screenshots provided before and after a full reboot and reset of the configuration I am glad to say that it is now functionnal. Thank you for the help @lan31

Hello Lan31, I very much appreciate your effort to help me here. I tried today the complete setup as described unfortunately i can't reach the desired result. Here are the details i can provide from my side: I set up the four ports of my lag as follows. Note before that i tried to have them in diefferent „Zones“ like DMZ.…

I already posted a comprehensive explaination here: https://community.zyxel.com/en/discussion/comment/37240/#Comment_37240 tl;dr: It was a FW routing issue. You said that printers did respond. Do they have the same gateway like PCs? Yes. Their gateway is are their respective USG60s. I cannot tell if it's your case, but…

Thank you for putting me on the right track. I think I am done (will check in detail later). Allow me to elaborate: A local firewall can define a subset of addresses inside its rules.And many rules in "Windows firewall", by default, have as default scope "Local subnet". I understand now. This was not the issue. Win10…

The devices do respond to ping from the same net.So the issue is not on the device. Sorry if I was not clear enough on that. I will edit my post to reflect that. Edited the post to be more clear that pings within networks to target machines work. But through VPN they don't. I can only ping the edges of the net (the 2…

Hi Jeff. Sorry for the exceptionally late reply. Unfortunately, our business needed my elsewhere for a while. I did spot the access blocked triggered by the default rule in the logs. I did create a policy LAN1 to any, but pings are still not going through. But they are also not showing up as blocked anymore. Here is what…

I'll try that tomorrow at the latest and report back with findings.

A Ping from HQ to branch indeed works. But pings from branch to HQ don't: Pings in HQ:C:\Users\hq-pc>ping 192.168.178.1<br><br>Ping wird ausgeführt für 192.168.178.1 mit 32 Bytes Daten:<br>Antwort von 192.168.178.1: Bytes=32 Zeit=16ms TTL=61<br>Antwort von 192.168.178.1: Bytes=32 Zeit=18ms TTL=61<br>Antwort von…