ZyXEL Communications ZYWALL USG 20 Manual page 732

Chapter 50 Troubleshooting
• Make sure you recorded your DDNS account's user name, password, and
domain name and have entered them properly in the ZyWALL.
• You may need to configure the DDNS entry's IP Address setting to Auto if the
interface has a dynamic IP address or there are one or more NAT routers
between the ZyWALL and the DDNS server.
• The ZyWALL may not determine the proper IP address if there is an HTTP proxy
server between the ZyWALL and the DDNS server.
I cannot create a second HTTP redirect rule for an incoming interface.
You can configure up to one HTTP redirect rule for each (incoming) interface.
Make sure you have the FTP ALG enabled.
The ZyWALL keeps resetting the connection.
If an alternate gateway on the LAN has an IP address in the same subnet as the
ZyWALL's LAN IP address, return traffic may not go through the ZyWALL. This is
called an asymmetrical or "triangle" route. This causes the ZyWALL to reset the
connection, as the connection has not been acknowledged.
You can set the ZyWALL's firewall to permit the use of asymmetrical route
topology on the network (so it does not reset the connection) although this is not
recommended since allowing asymmetrical routes may let traffic from the WAN go
directly to the LAN without passing through the ZyWALL. A better solution is to
use virtual interfaces to put the ZyWALL and the backup gateway on separate
subnets. See
for more information.
I cannot set up an IPSec VPN tunnel to another device.
If the IPSec tunnel does not build properly, the problem is likely a configuration
error at one of the IPSec routers. Log into both ZyXEL IPSec routers and check the
settings in each field methodically and slowly. Make sure both the ZyWALL and
remote IPSec router have the same security settings for the VPN tunnel. It may
help to display the settings for both routers side-by-side.
732
Asymmetrical Routes on page 381 and the chapter about interfaces
ZyWALL USG 20/20W User's Guide