ZyXEL Communications ZyWall Mode d'emploi

1/26

www.zyxel.com

ZyWALL (ZLD) VPN Troubleshooting

L2TP VPN will not connect

No traffic flow through L2TP VPN tunnel

Client-to-Site (RoadWarrior) VPN will not connect

No traffic flow through client-to-site IPSec VPN tunnel (RoadWarrior)

Site-to-Site VPN will not establish

No traffic flow through site-to-site IPSec VPN tunnel

SSL VPN connection will not establish

Connection issues with SSL VPN

L2TP VPN will not connect

Please verify your VPN rule setup with the example provided on the

“ZyWALL_L2TP_VPN_Setup.pdf” walkthrough. If your setup is similar to

the example provided please check the following:

Is the ZyWALL behind a NAT (another router)? The L2TP function

will not work if the ZyWALL is behind another router. This is a

limitation on the devices L2TP capability, the ZyWALL needs direct

communication with the public network (internet).

If the L2TP client is behind a router please make sure that VPN

pass-through is enabled or create port forwarding rules so it does

not block the L2TP communication to the ZyWALL.

2/26

www.zyxel.com

Does the client have any other VPN clients installed? Only one

application can use the IKE/IPSec services at a time, if there is

another VPN client installed on the computer (and running) such

as Cisco IPSec client, TheGreenBow, ShrewSoft, etc., you will

need to close the application completely and restart the

IKE/IPSec services so that the L2TP client can use them.

[Windows]

To restart the services on your computer open a RUN dialog box.

You can access this by pressing the Windows + R keys on the

keyboard.

Type “services.msc” and click OK or hit the Enter/Return key.

3/26

www.zyxel.com

Scroll down the list to find the ‘IKE and AuthIP IPsec Keying

Modules’ and ‘IPsec Policy Agent’ to restart these services.

Please check your L2TP clients settings against our setup

example(s) [link to Windows, macOS, iOS, etc., setup guides]

Disable your computers firewall to make sure it is not blocking the

VPN connection attempt.

Windows: To disable the Windows firewall, open a RUN dialog

box. You can access this by pressing the Windows + R keys on the

keyboard.

4/26

www.zyxel.com

Type “firewall.cpl” and click OK or hit the Enter/Return key.

Select the option to “Turn Windows Firewall on or off” on the left.

Disable the firewall by selecting the “Turn off Windows Firewall”

and click the OK button to save the settings.

Note: If you’re using a third party software firewall, Trend Micro, Norton, McAfee,

etc., please open the softwares control panel and disable the firewall feature.

macOS: To disable the firewall on macOS open System

Preferences Security & Privacy, click the Firewall tab and press

the “Turn Off Firewall” button to disable.

5/26

www.zyxel.com

Update your computers NIC drivers.

Note: For updates to your computers NIC cards please visit the computer

manufacturer or the NIC cards chipset manufacturer.

Bypass your router (if possible) to make sure it is not blocking the

attempt to connect/establish the L2TP VPN.

Check the ZyWALL’s IKE logs to make sure it is receiving a request

to establish the VPN. By default the ZyWALL is programmed to

allow VPN traffic, if the IKE logs on the ZyWALL do not show any

IKE connection attempts try disabling the ZyWALL’s Firewall/Policy

Control. If still no luck, check with your ISP to make sure they are

not blocking ports on the service end.

To disable the ZyWALL’s firewall/policy control, go to:

Configuration Firewall OR Configuration Security

Policy Policy Control

6/26

www.zyxel.com

Verify the firmware is up to date and contact tech support for

further assistance. To check the current version of firmware on

the ZyWALL go to Maintenance File Manager Firmware

Package

7/26

www.zyxel.com

No traffic flow through L2TP VPN tunnel

Please follow the instructions below if you have successfully established

an L2TP VPN connection but cannot pass traffic through the tunnel.

By default L2TP clients are programmed to send all traffic through

the L2TP connection once established. If you have disabled this

option you will need to manually create routes on your devices

operating system to route traffic through the tunnel accordingly.

Make sure there are no IP conflicts. The ZyWALL’s internal (LAN)

IP scheme and the L2TP IP pool should be on different subnets,

using the same IP scheme can cause routing issues.

Create a policy route on the ZyWALL to specify that any traffic

destined for the L2TP IP Pool needs to take a hop (Next-Hop) at

the L2TP VPN tunnel. Configuration Network Routing 

Policy Route

Disable the ZyWALL’s Firewall/Policy Control.

To disable the ZyWALL’s firewall/policy control, go to:

8/26

www.zyxel.com

Configuration Firewall OR Configuration Security

Policy Policy Control

Make sure the L2TP connection has a higher priority than any

other route on your computer. On macOS you need to change

the service order to give the VPN connection a higher priority

than the Ethernet or Wi-Fi connections.

Windows: All routes for the L2TP interface should have a higher

metric than the standard routes. Open command prompt or

PowerShell and type route print to view the routing table.

macOS: Open System Preferences Network, click the

configuration icon at the bottom of the network

interface list and “Set Service Order”.

9/26

www.zyxel.com

Verify that the device you are trying to contact across the VPN is

pointing to the ZyWALL for its default gateway. If the device is

pointing to a different default gateway the traffic will not get sent

back through the L2TP VPN tunnel.

Verify the firmware is up to date and contact tech support for

further assistance. To check the current version of firmware on

the ZyWALL go to Maintenance File Manager Firmware

Package

10/26

www.zyxel.com

Client-to-Site (RoadWarrior) VPN will not connect

Please use the walkthrough “Dynamic_VPN_Setup_CR.pdf” as an

example to verify the setup on your ZyWALL, to make sure all necessary

settings and rules have been created on the router.

If the ZyWALL is behind a NAT (another router) make sure the first

NAT is forwarding the VPN ports to the ZyWALL. IKE UDP:500 and

NAT-T UDP:4500

Make sure your network router is allowing the IPSec ports through

(UDP:500 and UDP:4500) or be sure to enable VPN pass-through if

the router supports this option. Bypass the router if possible to

make sure it is not causing the problem.

Make sure your ISP is not blocking VPN ports, some providers will

block the VPN ports on their end.

Verify that your computers firewall is allowing communications

from the VPN client.

Update your NIC drivers (Ethernet and/or Wi-Fi).

Note: For updates to your computers NIC cards please visit the computer

manufacturer or the NIC cards chipset manufacturer.

Autres manuels pour ZyWall

Ce manuel convient aux modèles suivants

Autres manuels ZyXEL Communications Pare-feu

ZyXEL Communications

ZyXEL Communications ADSL 2+ Security Gateway Manuel utilisateur

ZyXEL Communications

ZyXEL Communications ZYWALL OTPV2 - Manuel

ZyXEL Communications

ZyXEL Communications ZyWALL 1050 Guide de référence

ZyXEL Communications

ZyXEL Communications ZyWALL SSL 10 Manuel utilisateur

ZyXEL Communications

ZyXEL Communications ZyWALL 1050 Mode d’emploi

ZyXEL Communications

ZyXEL Communications USG Series Manuel utilisateur

ZyXEL Communications

ZyXEL Communications ZyWALL 1050 Manuel utilisateur

ZyXEL Communications

ZyXEL Communications ZyXEL ZyWALL 5 Manuel utilisateur

ZyXEL Communications

ZyXEL Communications ZyXEL ZyWALL 5 Manuel utilisateur

ZyXEL Communications

ZyXEL Communications ZyXEL ZyWALL 35 Manuel

ZyXEL Communications

ZyXEL Communications ZyWALL 1050 Manuel

ZyXEL Communications

ZyXEL Communications ZyWALL SSL 10 Manuel

ZyXEL Communications

ZyXEL Communications ZyWall ATP series Manuel utilisateur

ZyXEL Communications

ZyXEL Communications USG40 Manuel utilisateur

ZyXEL Communications

ZyXEL Communications ZyWall Manuel utilisateur

ZyXEL Communications

ZyXEL Communications ZyWALL 1100 Series Manuel utilisateur

ZyXEL Communications

ZyXEL Communications ZyXEL ZyWALL IDP 10 Manuel

ZyXEL Communications

ZyXEL Communications ZyWall Manuel utilisateur

ZyXEL Communications

ZyXEL Communications ZyWALL 1050 Manuel

ZyXEL Communications

ZyXEL Communications ZyXEL ZyWALL 35 Manuel utilisateur

ZyXEL Communications

ZyXEL Communications ZyXEL ZyWALL 35 Manuel utilisateur

ZyXEL Communications

ZyXEL Communications ADSL 2+ Security Gateway Manuel utilisateur

ZyXEL Communications

ZyXEL Communications ZyXEL ZyWALL 5 Manuel

ZyXEL Communications

ZyXEL Communications ADSL 2+ Security Gateway Manuel utilisateur

Manuels Pare-feu populaires d'autres marques

Cisco

Cisco S190 Manuel utilisateur

Fortinet

Fortinet FortiGate Voice Series Manuel utilisateur

ADTRAN

ADTRAN NetVanta 2300 Manuel utilisateur

SecureLogix

SecureLogix ETM System Manuel utilisateur

NETGEAR

NETGEAR ProSafe FVX538 Manuel utilisateur

Lanner

Lanner FW-8877 Manuel utilisateur

Huawei

Huawei USG6000 Series Manuel d'installation et d'exploitation

H3C

H3C SecPath F5000-AI-15 Manuel utilisateur

Nexcom

Nexcom DNA 1150 Manuel utilisateur

Fortinet

Fortinet FortiGate-60 series Manuel utilisateur

Cisco

Cisco 3110 Manuel

Draytek

Draytek Vigor2860 Series Manuel utilisateur

Lanner electronics

Lanner electronics FW-7650 Series Manuel utilisateur

Swisscom

Swisscom Internet Backup Manuel utilisateur

SonicWALL

SonicWALL NSa 5700 Manuel utilisateur

DPtech

DPtech FW1000 SERIES Manuel utilisateur

FEITIAN

FEITIAN MultiPass FIDO Manuel utilisateur

EBLOCKER

EBLOCKER PRO Manuel utilisateur