How to Convert and Apply NSG Configuration to USG FLEX H Series

Prepare the FTP Connection

1. Open the command prompt on your PC by pressing Windows + R, type cmd, and click OK.

2. Navigate to the directory where the configuration file will be stored.

   cd C:\config

   (Example path only; use any preferred directory.)

Establish FTP Connection and Download the File

1. Open an FTP connection to the NSG gateway:

   ftp <IP address of the gateway>

   Example:

   ftp 192.168.1.1

2. Log in using an administrator account.
   Note: The password is the local credential configured in Nebula (NCC side-wide settings).

3. Navigate to the configuration directory:

   cd conf

4. Download the configuration file:

   get startup-config.conf

5. Confirm the download. The message “Transfer complete” indicates success.

Modify the NSG Configuration File

1. Open the downloaded startup-config.conf file using a text editor (for example, Notepad).

2. Delete the following lines from the file:

   • Lines starting with:

     ! model:
     

   • Lines starting with:

     ! firmware version
     

3. Save the file and rename it:

   • Keep the .conf extension

   • Do NOT name the file startup-config.conf

Configuration File Conversion and Model Check

Model Mapping Table

When converting an NSG configuration to USG FLEX H series, the following model mapping applies:

On the configuration converter web page: convert.cloud.zyxel.com

• Select the USG FLEX model as “From”

• Upload the modified NSG configuration file

Conversion Notes (Important)

• UTM Features
  UTM features are partially converted and may not function properly. All UTM settings and related firewall policies must be checked after conversion.

• VPN Conversion

  • NSG Nebula VPN (SD-VPN)

  • NSG Non-Nebula VPN (Auto-link VPN)
    will be converted to H series Nebula Manual-Link VPN.

Applying the Converted Configuration File

1. After conversion, save the converted configuration file.

2. Log in to the USG FLEX H series device.

Important Initialization Notes

• Initialization Mode
  You must select “Web Configurator” during initialization.
  If Nebula is selected, all configuration will be replaced by Nebula default settings.

• Admin Password Reset
  After applying the converted configuration:

  • The admin password is reset to the H series default

  • Use the password printed on the device back label or try 1234

  • Change the password immediately after login

3. Navigate to:

   Web Configurator > Restore from a file

4. Upload the converted configuration file and apply it to the H series device.

Manual VPN Rule Adjustment (Mandatory)

1. Navigate to:

   IPsec VPN > Site to Site VPN
   

2. Identify failed SD-VPN rules:

   • VPN rule names starting with “S”

3. Manually remove/delete these failed VPN rules.

4. Manually create new SD-VPN rules according to your Nebula topology.

5. For other VPN rules:

   • Manually add them to the policy route

   • Modify and fill in the remote peer gateway information

Manual UTM Profile Adjustment (Mandatory)

1. Be aware that UTM features may not function correctly after conversion.

2. Review all UTM settings and related firewall policies carefully.

3. Navigate to:

   Security Services > Application Patrol
   

4. The Application Patrol profile name will be converted, but:

   • Profile rules

   • Application content
     will NOT be converted

5. Manually edit the Application Patrol profile and add the required application rules and content.

Conclusion

The NSG to USG FLEX H configuration conversion process requires manual validation and adjustment, especially for VPN and UTM features. Following each step exactly as described is essential to ensure a successful migration and stable operation.