ZyXEL Communications Unified Security Gateway ZyWALL 300, User Manual

Page: 934 / 1156

Chapter 57 Troubleshooting
ZyWALL USG 300 User’s Guide
934
Device HA is not working.
• You may need to disable STP (Spanning Tree Protocol).
• The master and its backups must all use the same device HA mode (either
active-passive or legacy).
• Configure a static IP address for each interface that you will have device HA
monitor.
• Configure a separate management IP address for each interface. You can use it
to access the ZyWALL for management whether the ZyWALL is the master or a
backup. The management IP address should be in the same subnet as the
interface IP address.
• Enable monitoring for the same interfaces on the master and backup ZyWALLs.
• Each monitored interface must have a static IP address and be connected to the
same subnet as the corresponding interface on the backup or master ZyWALL.
• If you have multiple ZyWALL virtual routers on your network, use a different
cluster ID to identify each virtual router. There can only be one master ZyWALL
in each virtual router (same cluster ID).
A broadcast storm results when I turn on Device HA.
Do not connect the bridge interfaces on two ZyWALLs without device HA activated
on both. Either activate device HA before connecting the bridge interfaces or
disable the bridge interfaces, connect the bridge interfaces, activate device HA,
and finally reactivate the bridge interfaces.
I cannot get the RADIUS server to authenticate the ZyWALL‘s default admin
account.
The default
admin
account is always authenticated locally, regardless of the
authentication method setting. (See Chapter 44 on page 757 for more information
about authentication methods.)
The ZyWALL fails to authentication the ext-user user accounts I configured.
An external server such as AD, LDAP or RADIUS must authenticate the ext-user
accounts. If the ZyWALL tries to use the local database to authenticate an
ext-