mMontana  Guru Member

@mm_bret thanks for your experience. I managed to install and update ventura, however my client still won't trying to connect/recreate l2tp connection. Now I have evidence that everything works as intended, however… PITA to destroy-than-redo (more or less) the VPN connection from USG60w flavour to USG Flex 100W flavour.…

Thanks for sharing.

I'd love to know how it should be, if you can @PeterUK

Sorry… again: USGFlex 200 firewall allow connection from wan to port 80 of 192.168.1.30? You have a specific firewall rule to allow that? Side question: USGFlex 200 firewall allow connection from wan on port 7980?

I installed more or less 5 of that switches, which when rebooted were working without issues from 1500 to 3000 hours. Consider to update firmware, if not already done (shortly after the reboot), or inspect your cables. Maybe something triggers the switch in the wrong way.

USGFlex 200 firewall allow connection from wan to port 80 of 192.168.1.30? Does the firewall on device at 192.168.1.30 read connections from outside the LAN?

Would you please explain what should be a "killswitch" into a router … what should do… And why you're expecting it?

Thanks for both answers. I do not have any experience nor knowledge on HA solutions, but your answers eased some possible doubts that readers of your first post might had. Don't forget that… you cannot NAT twice on the same device for the same port. Unless you do that on a trunk/VTI, instead on an interface…

@RSaull are you telling that your current idea is HA with a single firewall device for each ISP? Or you're looking to both ISP and firewall redundancy? May I assume that your Exchange Server is in fact a public-accessible email server?

Updates: I virtualized somehow Ventura, I updated to 13.4.5 and i were able to connect to the wizard-created L2TP tunnel. However, my test is not validating as "working", only the end user can validate. And he's on holydays. @Zyxel_James only local users for this setup. Would you please kindy answer to: -wan interface used…

If you are local to the device, consider this procedure: download the correct full file, keep close the serial cable and the procedure for disaster recovery of the firmware. Better in paper or local PDF than anything else access to USG20-VPN and reboot the device via web interface close the browser, start pinging the…

In reverse order: password, as defaulty policy, request special character, so there is. Special character is - Scripts generated from the wizard contain the WAN interface IP address (which is private) and not the static IP of the connection (which is public and managed by the ISP CPE). They did not work. The new VPN…

So don't forget to have two sets of rules: one for LAN zone (and i think you want it denied, so only the 3rd kind of rule) one for the Zywall.

I assume that USG Flex 700 is aware of vLAN 70. Which is the option you pick among these? In which zone the vLAN has been placed? After knowing these informations, I think you need to configure three security policies in this order 1st: allow destionations and services from vLAN 70 2nd: allow return from these destinations…

@dirodiro mr @Zyxel_Jeff decided that my post was the answer. Did help solve your problem?