Zyxel Nebula [Debugging] - Using the Local Web Interface

This article shows how to access your local interface, CLI/command line via SSH, how to collect Diagnostic file / tech-support file, perform a packet capture/packet trace on your USG FLEX, ATP, Switch or access point in Nebula. It also shows how to solve issues/problems, where to find the Nebula Password, and what to do if your device doesn't come online, set a static WAN/LAN address and use Command prompt [CMD]/Putty.

Note! Nebula CLI is only for troubleshooting purposes and not for configuration purposes. This is partly because Nebula is pushing configuration to the devices every 3 minutes. If you do any configuration in CLI and then when Nebula pushes new configurations to the device, the CLI changes you've made will be overwritten.

Access your Nebula Device

What's the Password of my Nebula Device?

a) If your device (firewall, switch, AP) has never been online in your Nebula organization and never registered in Nebula, you can enter the username "admin" and password "1234". 

b) If your firewall has never been online in your Nebula organization but registered in Nebula - you can use the serial number of your device using all capital letters (e.g. S102L17100072). You can find the serial number on the sticker under the device.

c) If your device (firewall, switch, AP) is online (or has ever been online before) in your Nebula organization, you can find the password in Nebula CC (under Site-wide -> Configure -> General Settings).

Access your Device via Web GUI

Find the right address

If you don't know the LAN address of your device. You can look at the primary LAN (usually lan1) in Nebula CC

Site-wide -> Configure -> Firewall -> Interface

or go to Switch / Access Point -> Switch / Access Point to view the list of the devices.

Also, make sure that you are on the correct LAN network before trying by opening CMD and typing

ipconfig

Login to your Nebula Device

Enter the LAN address of your Nebula device in your web browser (e.g. https://172.16.3.1) and click on "Network Test Tools" to come to the login page. Please use the "support" admin user for USG FLEX & ATP Series in Nebula.

Then enter the correct username & password (found in Section 1.2)

Access a Nebula Device via CLI

Access SSH via Command Prompt (CMD)

Note! To copy something into the command prompt, please right-click with your mouse.

If you only want access to SSH, you may access SSH via the built-in command prompt in your Windows PC. Write "ssh username@IP-address" to access the device (e.g. ssh admin@172.16.3.1). 

Then write "yes" to continue the connection.

Lastly enter the password of the device (unsure about what password to use? Click here).

Access SSH via Putty

Note! To copy something into Putty, please right-click with your mouse.

Enter IP Address

First fill in the IP address of the device and choose the right port (SSH = 22).

Log your output and choose file-path

Then click on "Session -> Logging" at the right-hand side and choose the "Session logging: All session output" and don't forget to choose the file path (or else it will not be saved to your PC locally).

Choose your path and the file name

Click "Save".

Check your Putty settings and then click Open

Accept your Host Key

Click on Accept to trust this host and be able to connect to the device via SSH.

Login with your credentials 

Again, to copy your password, please mark the window and then right-click. If you're unsure about what password and username to use, please check Section 1.2.

Configure a Nebula Device Locally

Firewall - Configure the Device Locally

Cloud Connection Status

Under device information, you can find what firmware you're on, serial number, MAC address and the Nebula Connectivity Status (Cloud Connection Status).

WAN Settings

If you need to set your WAN to static IP, you can do this in the local GUI under WAN Settings. 

Use the Network Tools

Navigate to Maintenance -> Network Tools to bring the Ping tool, Traceroute tool, NSLookup tool.

Switch / Access Point - Configure the Device Locally

Static LAN Settings

If you want to set your device from DHCP to static IP, you can navigate to Basic Setting -> IP Setup to configure the static LAN IP as shown below.

Diagnostic Tools

Navigate to Management -> Diagnostic to bring the Ping tool, Traceroute tool.

Diagnostic & Troubleshooting

Note! Nebula CLI is only for troubleshooting purposes and not for configuration purposes. This is partly because Nebula is pushing configuration to the devices every 3 minutes. If you do any configuration in CLI and then when Nebula pushes new configurations to the device, the CLI changes you've made will be overwritten.

My Device Cannot Come Online 

The most common issue when you're installing a device in Nebula is that it's not coming online. What you need to do in that case is to first search for the IP address via "Advanced IP scanner" program. If you cannot find it via "Advanced IP Scanner", you may search for it via ZON Utility Tool. 

If you can find the device IP and are able to login to the device. You can first try to ping 8.8.8.8 to see if you have internet connection. If you have internet connection, you may do a Traceroute to (d.nebula.zyxel.com - which is our Nebula servers) to see if your DNS settings is correct. You can also perform the NSLookup Tool to see if you can find the servers - because if you can't, it's probably a DNS issue and you need to change the DNS server to Google DNS [8.8.8.8] (See Section 2.2).

Also, if your having any problems with your device being offline, and you cannot resolve d.nebula.zyxel.com you might want to change the IP address of the device to static with the Google DNS Server (8.8.8.8).

Firewall - connection test from the device's local WEB GUI

• Go to a WEB interface of your device.
• Click "Network Test Tools" to login.

• Enter password to log in device

Note.The login password is stored in the site settings in Nebula. Go to Configure > Site settings to check local credentials.

• Go to the device information page, and click "Test" button.

We can provide the result to Zyxel support for further checking. This information helps address the device's offline issue.

3.3 Firewall - Diagnostic & Troubleshooting

3.3.1 Collect Diagnostic File

Navigate to Maintenance -> Diagnostic Info and click "Collect now". After it's been collected, click on "Download" to download the file locally.

3.4 Switch / Access Point - Diagnostic & Troubleshooting

3.4.1 Tech-Support File - Using Web GUI

'Navigate to Management -> Maintenance -> Tech-Support and click on "Click here".

3.4.2 Tech-Support File - Using SSH/CLI

3.4.2.1 For Nebula Switches

Enter the CLI of the switch via Putty using the guide found on Section 3.2 (don't forget to log the output so that you can save the file locally) and then enter the command:

show tech-support

3.4.2.2 For Nebula Access Point

Enter the CLI of the switch via Putty using the guide found on Section 3.2 (don't forget to log the output so that you can save the file locally) and then enter the command:

sshcon enable

Then

show tech-support all

Collecting the wireless tech-support file usually takes about 5 minutes.

After the tech-support has been collected, it should say "End of show tech-support":