ZyXEL Communications ZyWall Operating instructions

1/26
www.zyxel.com
ZyWALL (ZLD) VPN Troubleshooting
L2TP VPN will not connect
No traffic flow through L2TP VPN tunnel
Client-to-Site (RoadWarrior) VPN will not connect
No traffic flow through client-to-site IPSec VPN tunnel (RoadWarrior)
Site-to-Site VPN will not establish
No traffic flow through site-to-site IPSec VPN tunnel
SSL VPN connection will not establish
Connection issues with SSL VPN
L2TP VPN will not connect
Please verify your VPN rule setup with the example provided on the
“ZyWALL_L2TP_VPN_Setup.pdf” walkthrough. If your setup is similar to
the example provided please check the following:
Is the ZyWALL behind a NAT (another router)? The L2TP function
will not work if the ZyWALL is behind another router. This is a
limitation on the devices L2TP capability, the ZyWALL needs direct
communication with the public network (internet).
If the L2TP client is behind a router please make sure that VPN
pass-through is enabled or create port forwarding rules so it does
not block the L2TP communication to the ZyWALL.

2/26
www.zyxel.com
Does the client have any other VPN clients installed? Only one
application can use the IKE/IPSec services at a time, if there is
another VPN client installed on the computer (and running) such
as Cisco IPSec client, TheGreenBow, ShrewSoft, etc., you will
need to close the application completely and restart the
IKE/IPSec services so that the L2TP client can use them.
[Windows]
To restart the services on your computer open a RUN dialog box.
You can access this by pressing the Windows + R keys on the
keyboard.
Type “services.msc” and click OK or hit the Enter/Return key.

3/26
www.zyxel.com
Scroll down the list to find the ‘IKE and AuthIP IPsec Keying
Modules’ and ‘IPsec Policy Agent’ to restart these services.
Please check your L2TP clients settings against our setup
example(s) [link to Windows, macOS, iOS, etc., setup guides]
Disable your computers firewall to make sure it is not blocking the
VPN connection attempt.
Windows: To disable the Windows firewall, open a RUN dialog
box. You can access this by pressing the Windows + R keys on the
keyboard.

4/26
www.zyxel.com
Type “firewall.cpl” and click OK or hit the Enter/Return key.
Select the option to “Turn Windows Firewall on or off” on the left.
Disable the firewall by selecting the “Turn off Windows Firewall”
and click the OK button to save the settings.
Note: If you’re using a third party software firewall, Trend Micro, Norton, McAfee,
etc., please open the softwares control panel and disable the firewall feature.
macOS: To disable the firewall on macOS open System
Preferences Security & Privacy, click the Firewall tab and press
the “Turn Off Firewall” button to disable.

5/26
www.zyxel.com
Update your computers NIC drivers.
Note: For updates to your computers NIC cards please visit the computer
manufacturer or the NIC cards chipset manufacturer.
Bypass your router (if possible) to make sure it is not blocking the
attempt to connect/establish the L2TP VPN.
Check the ZyWALL’s IKE logs to make sure it is receiving a request
to establish the VPN. By default the ZyWALL is programmed to
allow VPN traffic, if the IKE logs on the ZyWALL do not show any
IKE connection attempts try disabling the ZyWALL’s Firewall/Policy
Control. If still no luck, check with your ISP to make sure they are
not blocking ports on the service end.
To disable the ZyWALL’s firewall/policy control, go to:
Configuration Firewall OR Configuration Security
Policy Policy Control

6/26
www.zyxel.com
Verify the firmware is up to date and contact tech support for
further assistance. To check the current version of firmware on
the ZyWALL go to Maintenance File Manager Firmware
Package

7/26
www.zyxel.com
No traffic flow through L2TP VPN tunnel
Please follow the instructions below if you have successfully established
an L2TP VPN connection but cannot pass traffic through the tunnel.
By default L2TP clients are programmed to send all traffic through
the L2TP connection once established. If you have disabled this
option you will need to manually create routes on your devices
operating system to route traffic through the tunnel accordingly.
Make sure there are no IP conflicts. The ZyWALL’s internal (LAN)
IP scheme and the L2TP IP pool should be on different subnets,
using the same IP scheme can cause routing issues.
Create a policy route on the ZyWALL to specify that any traffic
destined for the L2TP IP Pool needs to take a hop (Next-Hop) at
the L2TP VPN tunnel. Configuration Network Routing 
Policy Route
Disable the ZyWALL’s Firewall/Policy Control.
To disable the ZyWALL’s firewall/policy control, go to:

8/26
www.zyxel.com
Configuration Firewall OR Configuration Security
Policy Policy Control
Make sure the L2TP connection has a higher priority than any
other route on your computer. On macOS you need to change
the service order to give the VPN connection a higher priority
than the Ethernet or Wi-Fi connections.
Windows: All routes for the L2TP interface should have a higher
metric than the standard routes. Open command prompt or
PowerShell and type route print to view the routing table.
macOS: Open System Preferences Network, click the
configuration icon at the bottom of the network
interface list and “Set Service Order”.

9/26
www.zyxel.com
Verify that the device you are trying to contact across the VPN is
pointing to the ZyWALL for its default gateway. If the device is
pointing to a different default gateway the traffic will not get sent
back through the L2TP VPN tunnel.
Verify the firmware is up to date and contact tech support for
further assistance. To check the current version of firmware on
the ZyWALL go to Maintenance File Manager Firmware
Package

10/26
www.zyxel.com
Client-to-Site (RoadWarrior) VPN will not connect
Please use the walkthrough “Dynamic_VPN_Setup_CR.pdf” as an
example to verify the setup on your ZyWALL, to make sure all necessary
settings and rules have been created on the router.
If the ZyWALL is behind a NAT (another router) make sure the first
NAT is forwarding the VPN ports to the ZyWALL. IKE UDP:500 and
NAT-T UDP:4500
Make sure your network router is allowing the IPSec ports through
(UDP:500 and UDP:4500) or be sure to enable VPN pass-through if
the router supports this option. Bypass the router if possible to
make sure it is not causing the problem.
Make sure your ISP is not blocking VPN ports, some providers will
block the VPN ports on their end.
Verify that your computers firewall is allowing communications
from the VPN client.
Update your NIC drivers (Ethernet and/or Wi-Fi).
Note: For updates to your computers NIC cards please visit the computer
manufacturer or the NIC cards chipset manufacturer.