• To see how to do things in NCC, go to the Tutorials section.

• To know how to manage Mobile Routers in NCC, go to Configuration for more information.

• To know how to monitor Security Appliances in NCC, go to Monitor (Security Firewalls) or Monitor (Security Gateways) for more information.

• To know how to configure Security Appliances in NCC, go to Configure (Security Firewalls) or Configure (Security Gateways) for more information.

• To know how to monitor Switches in NCC, go to Monitor for more information.

• To know how to configure Switches in NCC, go to Configure for more information.

• To know how to monitor Access Points in NCC, go to Monitor for more information.

• To know how to configure Access Points in NCC, go to Configure for more information.

• Check that you are using the correct URL:

• Make sure your computer’s Ethernet card is installed and functioning properly.

• Check that you have Internet access. In your computer, click Start, (All) Programs, Accessories and then Command Prompt. In the Command Prompt window, type ‘ping’ followed by a website such as ‘zyxel.com’. If you get a reply, try to ping ‘nebula.zyxel.com’.

• Make sure you are using the correct web browser that supports HTML5. View the browser in full screen mode to display the NCC portal properly. Browsers supported are:

• Check if the TCP/UDP port is blocked by your network’s firewall rule or ISP. Click Help > Support tools > Firewall information to view information required for firewall rules to allow management traffic between NCC and Nebula Devices on your sites.

• Check the Nebula Device’s hardware connections, and make sure the LEDs are behaving as expected. See the Quick Start Guide.

• If the LEDs still do not turn on, you may have a hardware problem. In this case, you should contact your local customer support.

• Make sure the Nebula Device is connected to the Internet.

• For Mobile Routers, make sure a valid SIM card is inserted in the SIM card slot.

• Make sure the Mobile Router is located where the cellular signal is strong.

• For ZyWALL USG FLEX / ATP / USG20(W)-VPN Series devices with Nebula native mode as the deployment method, make sure you perform the steps for Nebula native mode on the Nebula Device; see Nebula Native Mode for information.
If you select Zero Touch Provision mode as the deployment method. Make sure you perform the steps for Zero Touch Provision mode on the Nebula Device, see Zero Touch Provision Mode for information.

• Check if the WAN IP address is configured on the Nebula Device.

• Check if the Nebula Device can access the NCC server’s domain through SSH/Console and enter ‘nslookup d.nebula.zyxel.com’. If the Nebula Device shows ‘unknown host’, check your DNS server setting or use ‘8.8.8.8’ as the DNS server on the Nebula Device.

• The Nebula Devices will apply the site-wide password after getting online on NCC. Check the login credential by going to Site-wide > Configure > Site settings: Local credentials.

• Specify the Port number and click Establish using Remote Access in the following screens to obtain real-time logs and data from the Nebula Device.

• Make sure that your Nebula Device can connect to the NCC by checking your network’s firewall/security settings. The following ports must be allowed:

• Make sure that your Nebula Device can synchronize with NTP (Network Time Protocol) through the following port:

• Make sure that your Nebula Device can resolve the Nebula Cloud Management (NETCONF) domain name d.nebula.zyxel.com.

• Changing the MTU (Maximum Transmission Unit) size in Site-wide > Configure > Firewall > Interface > WAN/LAN interface configuration may cause the Nebula Switches to appear offline. Make sure that the MTU size is not smaller than 1500 bytes.

• Check the Nebula Device’s local Web Configurator’s Dashboard. The Cloud Control Status displays the status of the Nebula Device’s Internet and NCC connection and registration status. Make sure that the Nebula Device has NCC Discovery enabled.

• If the Nebula Device cannot connect to the Internet or NCC, hover the mouse over the Internet circle to check the error message. Check your local network settings.

• Make sure that your Nebula Device can connect to the NCC by checking your network’s firewall/security settings. The following ports must be allowed:

• Make sure that you have registered your Nebula Devices with the NCC. See License & Inventory Overview Screen.

• Make sure that you have created an organization and site and added the Nebula Devices to the site. See Create Organization .

• When the Nebula Device is online in NCC, all circles are green.

• In Organization-wide > License & inventory > Overview, click Upgrade Now to upgrade the organization to Plus or Professional tier.

• Alternatively, remove the unlicensed Nebula Device(s) from the organization.

• Click the Cloud-saving mode switch in the Welcome back pop-up window.
Then click Close to turn off Cloud-saving mode for the organization.

• A banner displays when NCC is in Cloud-saving mode.
Click the You could change mode here link in the NCC banner.
Click the Cloud-saving mode switch in the Cloud-saving mode pop-up window.
Then click Close to turn off Cloud-saving mode for the organization.

• Select Use the following address or coordinates to enter the complete address or coordinates of the Nebula Device in Site-wide > Devices > Firewall / Security gateway / Switches / Access points: details: Map: Position device.

• Select Get my location from web browser to use the public IP address of the computer accessing the NCC portal.

• Drag-and-drop your Nebula Device directly on the Google map.

• Make sure the Nebula Security Firewall and Nebula Access points are in the same NCC site.

• Make sure a Secure WiFi license is assigned to the Nebula Security Firewall.

• Make sure to configure the Remote AP Setting of each Remote Access Point before booting up the Remote Access Point in the remote site. See Site-wide > Devices > Access points: Details.

• The maximum number of Remote Access points depends on the Nebula Security Firewall.

• Click Reconnect in Site-wide > Devices > Access points: Uplink AP to re-establish connection.

• Make sure your Nebula Device supports smart mesh. To view the list of Nebula Devices that support smart mesh, go to Help > Device function table.

• Make sure you enable AP Smart Mesh in Site-wide > Configure > Access points > AP & port settings. See AP & Port Settings for more information.

• Make sure you enable Downlink in Site-wide > Devices > Access points: Details. See Access Point Details for more information.

• To enhance your mesh extender’s connectivity, maintain an Uplink signal strength above -65 dBm. You can check this in Site-wide > Devices > Access points.

• Make sure that you have the power cord connected to the Nebula Device and plugged in to an appropriate power source. Make sure you have the Nebula Device turned on.

• Check all cable connections. See the related Quick Start Guide.

• If the LEDs still do not turn on, you may have a hardware problem. In this case, you should contact your local customer support.

• The Nebula Device has a power-related error. Disconnect and reconnect the power cord. Make sure that you are using the included power cord for the Nebula Device and it is plugged into an appropriate power source. See the related Quick Start Guide.

• If the LED is still red, you may have a hardware problem. In this case, you should contact your local customer support.

• Contact your vendor about the faulty Nebula Device.

• Do NOT remove or swap the faulty Nebula Device in NCC.

• Contact Zyxel Customer Support to keep the faulty Nebula Device’s port configuration and apply it to the new Nebula Device.

• Make sure the DNS server used by your Nebula Device can resolve the domain name ‘firmware.nebula.zyxel.com’.

• Make sure there are no firewall policies restricting access to ‘firmware.nebula.zyxel.com’ and that the firewall allows connection to TCP port 443.

• If there is no firewall policy restricting access, log in to the Nebula Device Web Configurator to get the technical support log from the following location:

• Contact Zyxel Customer Support for help.

• Go to Site-wide > Configure > WiFi SSID settings to configure a separate WiFi network for the IoT device(s).

• Go to Site-wide > Configure > Access points > SSID advanced settings and select the separate WiFi network in the previous step. Select WPA Personal With WPA2 in Security options.

• Select the 2.4GHz band in Band mode. The smartphone with IoT app and IoT device must connect to an SSID on the 2.4 GHz band. This enhances the connectivity and performance of IoT devices.

• Disable 802.11k/v/r in Assisted roaming and 802.11r. This prevents the Nebula Device from steering IoT devices to the 5 GHz band.

• Disable Layer 2 isolation in Advanced settings. An IoT device's MAC address that is not in the Layer 2 isolation table will not be able to communicate with other devices in the same WiFi network when layer-2 isolation is enabled.

• Disable Intra-BSS traffic blocking in Advanced settings. This allows direct communication between IoT devices from within the same WiFi network.

• Go to Site-wide > Configure > WiFi SSID settings. Configure the same Tagging for the same WiFi network and the Tag for the Nebula Device in Site-wide > Devices > Access points. For example, tagging Nebula Device A with "Lobby" in Site-wide > Devices > Access points and assigning the "Lobby" tag to "SSID_lobby" in Site-wide > Configure > WiFi SSID settings means that Nebula Device A will broadcast "SSID_lobby."

• Go to Site-wide > Configure > Radio settings and disable Allow 802.11ax/ac/n stations only. This allows the IEEE 802.11a/b/g IoT devices to connect.

• Check the WiFi LED status to make sure the Nebula Device WiFi is on.

• Make sure the WiFi client is within transmission range of a Nebula Device.

• Make sure the WiFi client entered the correct SSID (Service Set IDentifier) and pre-shared key (PSK). Go to Site-wide > Configure > WiFi SSID settings for the correct SSID and PSK.

• Make sure your WiFi client is using the same WiFi security type (PSK or open) as the Nebula Device.

• Make sure the WiFi adapter on your WiFi client is working. Right-click your WiFi client computer's network adapter and then select Properties to check the network adapter status.

• Make sure the WiFi adapter on your WiFi client is IEEE 802.11-compatible. Make sure it supports the same WiFi standard as the Nebula Device 2.4G/5G radio.

• Select MAC authentication fallback in Site-wide > Configure > Access points > SSID advanced settings: Sign-in method. If MAC authentication fails, the WiFi client will use web authentication with a user name and password.

• Go to Site-wide > Configure > Access points > SSID advanced settings: Advanced settings and turn on IEEE 802.11r fast roaming on the Nebula Device. 802.11r fast roaming reduces the delay when the clients switch from one Nebula Device to another by storing the security keys on all Nebula Devices in a network. Information from an original association is passed to the new Nebula Device when the clients roam. The clients do not need to perform the 802.1x authentication process again.

• At the time of writing, Nebula Devices will log all events. You will not be able to restrict the type of logs written.

• You can choose the type of logs to generate only in Standalone mode by doing the following:

• Enter “http://neverssl.com” in the Location or Address field of your browser. This allows you to access the NCC login page by bypassing SSL (Secure Sockets Layer). SSL creates an encrypted link between a web server and a web browser.

• Make sure the Nebula Device has been removed from your organization. Go to Organization-wide > License & inventory > Devices. Select the Nebula Device, click Actions, then click Remove from organization. Click Yes to confirm, or click the delete icon to remove the Nebula Device.

• Make sure to reset the Zyxel Device to its factory-default settings. This will remove the current configuration.