Zyxel Zywall - VPN issues, firmware updates, problems, review

Firmware updates for Zywall products

If you happen to have any Zyxel Zywall products (such as the USG 50, USG 200, etc.), keep your eyes out for firmware updates.  It is clear to me that they are consistently having to update their firmware, and there have been a lot of changes recently.  For the USG 200 product alone, there have been at least two firmware updates in only 3 months!

Zyxel Zywall USG 200 firmware updates - http://us.zyxel.com/Support/Download-Library-Result.aspx?mif=20070329092030

All Zyxel support downloads - "Download Library" - http://us.zyxel.com/Support/Download-Library.aspx.

It would be nice if they sent out an email notification every time their was a new firmware release!

Nailed-up VPNs

Regarding setting up VPNs on Zywall USG products, if you have a problem where your VPN connections do not restore automatically after a reboot, you may consider activating the "nailed-up" option in the Advanced Settings section of the VPN Connection tab for that particular connection.

According to a knowledge base article on the Zyxel site (article 1633), "nailed-up" as applied to PPP connections means: 

"A nailed-up connection is always up regardless of there is traffic transmitted. The ZyXEL Device performs two actions when the nailed-up feature is enabled. First, connection idle timeout is disabled. Second, the ZyXEL Device will try to bring up the connection when turned on and whenever the connection is down. A nailed-up connection can be very expensive for some reasons. It is always a better idea not to enable a nailed-up connection unless the broadband service provider offers flat-rate service or you need a constant connection and the cost is not a concern. You can enable/disable WAN connection nail-up in SMT menu 11 or the web GUI."

I did not find useful documentation, but I believe the term "nailed up" as applies to VPN has the same meaning - so in case you want your VPN connections to dial automatically after a reboot, consider this setting!  So far, I have not seen any negative affect for having used it.   If you were paying for metered/limited bandwidth and leave your VPN "nailed up", though, you may have consequences from your connection being in use at all times, so do be careful.  That said, for most people, site-to-site VPN connections are meant to be up constantly, so it isn't a problem.

Quick review of Zyxel as a vendor

Overall, having worked with a lot of vendor's firewalls over the years (Sonicwall, Watchguard, Zyxel and Cisco to name a few), I have to say, the Zyxel stuff is affordable, but not entirely intuitive and somewhat roughly documented.  That said, their tech support seems pretty responsive and helpful, as long as you only need their help during business hours (8-5PM Pacific Time).
  
Phew, it's been a while since I had time to post any tips!