Zyxel USG20-VPN, behind Comcast gateway modem router, passthrough mode, only used as modem. Wireless router is configured as WAP, is not in front of USG20
HP Spectre X360, Windows 10 Pro (12-2018)
Have used the USG20 for past few years with L2TP over IPSec VPN with preshared key configured in server role, no problems with VPN connections from my home (was Charter/Spectrum for ISP) using the embedded iOS and MacOS L2TP over IPsec VPN clients.
Changed to a Windows 10 laptop 12-2018, and no problems with connectivity using the Windows 10 embedded VPN client, same for one of my employees, who also has Charter/Spectrum for ISP.
Recently changed to gigabit fiber optic broadband from our local power board with symmetric 1 gigabit connection, no NAT function on their fiber optic modem, and the VPN connection fails with the error "can't connect to "VPN connection name" ...
No problem connecting from my iPhone or MacBook Pro, and my employee still has connectivity coming from a Charter/Spectrum IP address.
No difference whether connecting to my wireless router or directly to the modem.
I deleted the prior L2TP over IPsec configuration on the USG20, rebuilt it using one of the Zyxel wizards, with the same problem.
The security settings on the adapter generated with Windows 10 were already CHAP/MSCHAP v2.
I found a number of posts on the Zyxel Biz Forum that reference a fix for Windows 10 clients that were never able to successfully connect, requiring the registry change added via command line "REG ADD HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent /v AssumeUDPEncapsulationContextOnSendRule /t REG_DWORD /d 0x2 /f followed by reboot to allow the registry change to take effect.
That has had no impact on this problem.
Examination of the IKE log indicates that the tunnel is created, then the Windows 10 client sends the same delete notification to disconnect the tunnel that is sent by the iOS or MacOS clients when the VPN connection is manually closed as per attached file where IP addresses are redacted/
The ISP hasn't been able to find an explanation for this problem, and even came out and installed a new modem, without any impact.
I can use RDP directly without a VPN tunnel to connect to the office server at the office external static IP, and there are no security rules on the USG20 to block connections from the IP addresses used by my new ISP.
Thanks
