SS V1 still not connecting after change of ISP

[jcsager]

I changed ISP last wednesday, 17th, so consequently my external IP address changed, and our SureSignal V1 gateway promptly stopped working. I have assumed that was some kind of security process within Vodafone to block SS boxes on sudden change of IP to a different provider. Since this probably happens fairly often I would assume it should be one of the standard helpdesk actions to unblock in this situation, but I have got nowhere with the helpdesk. They basically assume that the problem is nothing to do with Vodafone and must be down to me or my ISP. However, nothing has changed my end - same router, same firewall settings, just a change of external IP address. My new ISP, AAISP has a declared reputation for not blocking anything so they are unlikely to be blocking any of the SS traffic.

I have traced the traffic with tcpdump and this is what happens. My SS box sends a IKE_INIT to 212.183.133.177 on UDP port 500 and gets a IKE_INIT reply. It then sends the initial message of an ISAKMP security association setup transaction to the same address on UDP port 4500 but gets no response. Periodically it will try again with the IKE_INIT but it never gets anywhere. The NTP traffic from the SS box to 212.183.133.181 for clock sync works perfectly. I have the packet capture files if they would help at all.

Please can someone from Vodafone contact me on the e-mail address associated with my handle on this forum so I can give you my mobile number, and you can remove the block on my box. The SSV1 serial number is 21502536929

[Ben_H]

Hi @jcsager ,

Thanks for posting your serial number. Your unit hasn't connected to our servers since 17 December. As your Sure Signal is likely looking for the old ISP, I've pushed a manual resync down for you. To complete the operation please:

• Hold down the power button for the Sure Signal until all the lights flash.
• Switch off your router.
• Wait 30 seconds.
• Switch the router back on.

It'll take an hour or so for the Sure Signal to set back up again.

If you'd rather not mess with the router power, deregistering your Sure Signal, then registering it again will have the same effect.

Cheers,

Ben

[jcsager]

Tried that reset method (5 or 6th reset) and still no luck. I do believe there is some kind of network block somewhere. The ISAKMP phase 1 transaction on UDP port 500  to 212.183.133.177 works, as do the NTP queries to sync the femtocell clock. The traffic that fails is ISAKMP phase 2 on UDP port 4500 to the same address. I send a request but get no response. I would at the least expect a response, even if it was just "go away". I have tested traffic on UDP port 4500 from my home network to a server at a friend's on another ISP and that works fine both ways, so I don't believe the problem is with my ISP (AAISP). Doing a traceroute to 212.183.133.177, traffic goes from AAISP to a NTT network & thence to Vodafone's (Cable&Wireless's?) entry point 195.2.30.61. I get no replies to traceroute thereafter. All the SureSignal support team on the landline equivalent of 191 can tell me is that they haven't had a connect from my box since 17th, and apparently they have no procedures within their processes to take this any further - not even any kind of escalation to a team who can do more detailed tests. I have asked my ISP to monitor traffic but I'm almost certain that will confirm that the problem does not lie within their network.

I do wish Vodafone could accept that there may possibly be a problem in their domain, and that a bit more effort by people who understand and can monitor network traffic will isolate this problem to its source and enable a fix to be done.

[Retired-Sarah]

Hi @jcsager 

So we can help further with this, please advise us who your new ISP is and the new IP address.

Your router manual or ISP can provide this.

Thanks,

Sarah

[jcsager]

ISP is Andrews & Arnold & my IP address is 81.2.83.97. Here is a traceroute to 212.183.133.177:

 1  192.168.xxx.xxx  1.076 ms  1.063 ms  1.634 ms
 2  90.155.53.52  26.153 ms  31.773 ms  32.042 ms
 3  90.155.53.44  32.216 ms  34.202 ms  35.894 ms
 4  83.217.238.93  38.125 ms  40.062 ms  42.249 ms
 5  129.250.3.30  44.468 ms  47.382 ms  48.365 ms
 6  129.250.66.46  49.823 ms  51.308 ms  51.912 ms
 7  195.2.30.5  53.346 ms 195.2.30.61  30.549 ms  27.242 ms

and then I get no replies. The SureSignal box is connected and retries every 11 minutes 24 secs +/- a second or two.

[Retired-Ian_]

Hi @jcsager 

Your ISP is fine.

The Sure Signal still hasn't made contact with our servers.

Please try the Sure Signal at another location, with a different ISP and let us know the light sequence you see.

Thanks,

Ian

[jcsager]

Problem solved! It turned out to be a MTU mismatch on the PPP link to my ISP. They have now changed MTU from 1500 to 1492 on my link and the SureSignal box now works fine. Thanks for the help here too.