PPPOE authentication with Plusnet FTTP not working

[#1]

Yeah, the Junos response is from our device so the Palo Alto doesn't get this far.

The test account I sent over which didn't work authenticates onto the BT device rather than ours so we can rule out the Plusnet router.

That also rules out any account issues or weird password characters or anything like that.

The first auth request here shouldn't check the password, it uses username to see whether it's a static or dynamic IP (with a few exceptions). There should be a 2nd auth as with the Plusnet Hub which validates the password. I'm trying to see if there are any hidden settings for the PPPoE/MD5/password but not having much luck.

[#2]

The first auth request here shouldn't check the password, it uses username to see whether it's a static or dynamic IP (with a few exceptions).

That's interesting, so its the 'name' that's not getting sent correctly ?

edit: have you noticed that with the pa220 it reports name = "username@plusdsl.net" in the debug log i.e lower case 'name' whereas the Hub 2 shows NAME= in the packet capture. Have we got an actual packet capture fro the pa220 ?

edit : ignore that , I've just seen the packet capture from the PA in the first post., it also sends uppercase NAME

[#3]

Dave, could you setup and send me the details for an account that uses PAP please for me to test?

That way we can start to narrow down whether it's a CHAP/PAP issue or something else

[#4]

Hi Dave, anymore on this?

[#5]

did you have any luck in sorting this?
i have a case open with Palo but never make any progress because they keep giving me someone in a time zone that is 8 hours behind.

[#6]

Hi I still need to log a call with them, will try and do it this weekend

[#7]

did you have any traction with Palo? they just kept arranging calls well out side of my time zone and not turning up, so iv given up after having the ticket open for 20 days. 

[#8]

I haven't got around to raising the call yet, will try this weekend if I can.

[#9]

Has anyone had any progress on this? Got a 440 and having the same issue

[#10]

I had a suport call open with Palo but they kept giving me someone in a different time zone and after a month i stopped  and just closed the ticket down. its a software issue that i dont think will get changed, 

[#11]

Right ok, 2 questions, do you have anything any extra info which would be helpful for me if I pick this up with them? We've got an ok account team I can try and escalate it through as well. This seems mad that it's even an issue!

I'm guessing the PCAPs you have contain all your account info so can't send them across?

Cheers

[#12]

Hi @pauser,

We did some packet captures with the BTW team to compare the Palo Alto router doing PPP vs a Plusnet Hub2 with one of the customers and this is the key part (I've blanked and customer specific values):

Palo Alto:

PPPoE Tags:
[0x0101] Service-Name: ""
[0x0103] Host-Unig: len = 4, value = XX XX XX XX
[0x0000] End-Of-List: len = 0
[0x0105] Vendor-Specific: vendor-id = 0x0de9 (ADSL Forum)
[0x01] Agent-Circuit-Id: "XXXX-OLT1 xpon X/X/X:X.XXX"
[0x02] Agent-Remote-Id: "BBEUXXXXXXXX"

Plusnet Hub 2:

PPPoE Tags:
[0x0101] Service-Name:
[0x0103] Host-Uniq: len = 4, value =XX XX XX XX
[0x0105] Vendor-Specific: vendor-id = 0x0de9 (ADSL Forum)
[0x01] Agent-Circuit-Id: "XXXX-OLT1 xpon X/X/X:X.XXX"
[0x02] Agent-Remote-Id: "BBEUXXXXXXXX"

The key difference is that End-of-List tag. The BTW guys tell me that the Nokia router it's connecting to will ignore anything sent after that tag i.e. they crucially ignore the BBEU number. The BBEU number is a unique identifier for each customer's broadband line, kind of like a phone number and that tells BTW which line is connecting. If the BBEU number is missing or in this case after the End-of-list tag so ignored they will reject the authentication attempt straight away without even sending it on to Plusnet to see if you've got the right username and password.

The thing we don't understand is why the Palo Alto device is sending this tag (the Hub 2 doesn't) and what's different for FTTP to FTTC in this sense because the Palo Alto just doing PPPoE wouldn't see any difference so you would expect it to be the same.

We've spoken to Openreach too to see if they can help shed any light and without having a Palo Alto device and both an FTTC and FTTP line set up in the same way our best guess is this is an interoperability issue between the Palo Alto CPE and the particular vendor on FTTP and that the change from FTTC to FTTP resulted in a change of vendor between the FTTC DSLAM and the FTTP OLT/ONT where the FTTC vendor stripped or ignored the End-of-list tag but the FTTP vendor doesn't. The standards suggest that the fix should be in the Palo Alto space because the End-of-list tag is a valid use case and the behaviour we're seeing from the BTW Nokia device is correct and valid as is the behaviour from the Openreach OLT and that the oddity here from the standards is that it worked on Openreach FTTC not that it doesn't work on FTTP and I fear that if I raised a statement or requirements into Openreach to fix this it wouldn't get a high priority to be resolved (I've spoken to a couple of other ISPs as well and so far the only people in the country we've confirmed as being affected have posted in this thread, I'm sure there would be others but they may have just switched CPE rather than raise it with the ISP).

I think the fix for Palo Alto is straight forward to explain, remove the End-of-list tag in the PPP, I obviously don't know how easy that is to fix.

I hope that helps but if I can provide any information let me know.

[#13]

Hi, that is super useful, I'll open a ticket with Palo and see where we get to, when I hear back I'll update this thread.

Cheers

[#14]

Ticket opened so we shall see!!

@leighboy
@witherford
@MisterW

If you want let me know what hardware and software versions your on and I'll add to the ticket that I've seen it on these platforms too. I'm on a 440 and 10.1.5-h1

Cheers

[#15]

@pauser  I don't have a palo alto, I'm just here as an interested party, trying to help ( if I can )  understand why it doesn't work. For info I'm not running a PN Hub 2 either, I'm using a tplink er605 which works fine on Full fibre.