perhaps if i set my "device management" to an external fqdn... have to be careful, the remote device is 400 miles away... have it set for a subnet ip now.

is there a way to get detailed logs out of this equipment?

  @atc 

Good morning, 

Exactly the same problem here.

We have 5 sites, all connected over VPN to an OC200 controller. Fantastic system that really does the job. Cannot praise the TPLink people enough.

The only thing that keeps refusing to cooperate is the update. I need to update my remote gateways ER605 from V2.0.0 to V2.1.2 but can't seem to get the job done when the device is controlled by the OC200. 

Whilst everything is correctly configured, all ports are open, updates keep failing with the following message:

Upgrade over VPN keeps failing

All ports open...

As you can see above all necessary ports are accessible on the side of the device.

I keep searching for a solution but I hope the support team of TPLink can jump in. They are welcome to log into our system ;-) 

All the best,

Stefaan. 

  @MeninGate I am using the software controller which may have different port requirements.  The solution for me was opening TCP 8043 inbound in addition to 29811-29814 and UDP 29810.  Not sure about the hardware controller.  Good luck.

  @jameslmoser - good to know.  I got a hadrware controller recently and have not yet lived through an upgrade.  I have not made any changes to my firewall config so we will see if the next upgrade fails or not!   Last month I did successfully upgrade the ER7206 router with the hardware controller, and I successfully installed a self-signed certificate so I do not get the silly error that the site may not be safe when opening the web UI.  So far so good with the hardware controller...