ZyXEL Communications 200 Series User Manual

ZyWALL USG 100/200 Series User’s Guide

This chapter offers some suggestions to solve problems you might encounter. 

V

I cannot set up an IPSec VPN tunnel to another device.

If the IPSec tunnel does not build properly, the problem is likely a configuration error at one of 
the IPSec routers. Log into both ZyXEL IPSec routers and check the settings in each field  
methodically and slowly. Make sure both the ZyWALL and remote IPSec router have the 
same security settings for the VPN tunnel. It may help to display the settings for both routers 
side-by-side.

Here are some general suggestions. See also 

• The system log can often help to identify a configuration problem.

• If the sites are/were previously connected using a leased line or ISDN router, physically 

disconnect these devices from the network before testing your new VPN connection. The 
old route may have been learnt by RIP and would take priority over the new VPN 
connection.

• To test whether or not a tunnel is working, ping from a computer at one site to a computer 

at the other. 
Before doing so, ensure that both computers have Internet access (via the IPSec routers).

• It is also helpful to have a way to look at the packets that are being sent and received by 

the ZyWALL and remote IPSec router (for example, by using a packet sniffer). 

Check the configuration for the following ZyWALL features.

• The ZyWALL does not put IPSec SAs in the routing table. You must create a policy route 

for each VPN tunnel. See 

• Make sure the To-ZyWALL firewall rules allow IPSec VPN traffic to the ZyWALL. IKE 

uses UDP port 500, AH uses IP protocol 51, and ESP uses IP protocol 50.

• The ZyWALL supports UDP port 500 and UDP port 4500 for NAT traversal. If you 

enable this, make sure the To-ZyWALL firewall rules allow UDP port 4500 too.

• Make sure regular firewall rules allow traffic between the VPN tunnel and the rest of the 

network. Regular firewall rules check packets the ZyWALL sends before the ZyWALL 
encrypts them and check packets the ZyWALL receives after the ZyWALL decrypts 
them. This depends on the zone to which you assign the VPN tunnel and the zone from 
which and to which traffic may be routed.

• If you set up a VPN tunnel across the Internet, make sure your ISP supports AH or ESP 

(whichever you are using).