ZyXEL Communications USG FLEX H Series - I cannot get the application patrol to manage FTP traffic.; The Zyxel Device keeps resetting the connection.; I cannot set up an IPSec VPN tunnel to another device.

Chapter 29 Troubleshooting
USG FLEX H Series User’s Guide
429
• The Zyxel Device may not determine the proper IP address if there is an HTTP proxy server between the
Zyxel Device and the DDNS server.
I cannot get the application patrol to manage FTP traffic.
Make sure you have the FTP ALG enabled.
The Zyxel Device keeps resetting the connection.
If an alternate gateway on the LAN has an IP address in the same subnet as the Zyxel Device’s LAN IP
address, return traffic may not go through the Zyxel Device. This is called an asymmetrical or “triangle”
route. This causes the Zyxel Device to reset the connection, as the connection has not been
acknowledged.
You can set the Zyxel Device’s security policy to permit the use of asymmetrical route topology on the
network (so it does not reset the connection) although this is not recommended since allowing
asymmetrical routes may let traffic from the WAN go directly to the LAN without passing through the
Zyxel Device. A better solution is to use virtual interfaces to put the Zyxel Device and the backup
gateway on separate subnets. See
Asymmetrical Routes on page 192 and the chapter about interfaces
for more information.
I cannot set up an IPSec VPN tunnel to another device.
If the IPSec tunnel does not build properly, the problem is likely a configuration error at one of the IPSec
routers. Log into both Zyxel IPSec routers and check the settings in each field methodically and slowly.
Make sure both the Zyxel Device and remote IPSec router have the same security settings for the VPN
tunnel. It may help to display the settings for both routers side-by-side.
Here are some general suggestions. See also IPSec VPN.
• The system log can often help to identify a configuration problem.
• If you enable NAT traversal, the remote IPSec device must also have NAT traversal enabled.
• The Zyxel Device and remote IPSec router must use the same authentication method to establish the
IKE SA.
• Both routers must use the same negotiation mode.
• Both routers must use the same encryption algorithm, authentication algorithm, and DH key group.
• When using pre-shared keys, the Zyxel Device and the remote IPSec router must use the same pre-
shared key.
• The Zyxel Device’s local and peer ID type and content must match the remote IPSec router’s peer
and local ID type and content, respectively.
• The Zyxel Device and remote IPSec router must use the same active protocol.
• The Zyxel Device and remote IPSec router must use the same encapsulation.
• The Zyxel Device and remote IPSec router must use the same SPI.