Sure Signal v3 not Working in workplace.

[TK2NETADMIN]

Hi 

I have a sure signal device which is erroring with a flashing red light and 2 x Amber lights when installed in my workplace. I can see that the device is attempting to communicate to NTP servers and to vap.vodaphone.co.uk, but that communication appears unsuccessful. 

Ping to vap.vodaphone.co.uk (212.183.133.177) in unsuccessful and a traceroute to this address terminate at hop 4 (195.2.22.217 - ae9-xcr1.lns.cw.net). 

I know the device itself is not faulty as it work OK when installed to a domestic home enviroment. 

When installed at my work place the device is installed into a DMZ behind a firewall, but I have verified all devices within the DMZ area have full ip connectivity to the internet with no restrictions. 

Are you able to offer any explanation for failure to connect to vap.vodafone from our offices? Is whitelisting required?

Serial number: 40132751492

Mac Address: B046FC9EBDB6

Regards

Ian

[Jenny]

@TK2NETADMIN - We can’t guarantee the Sure Signal will work with a more complex set up, but take a look at the following:

Please see the following for a list of IP addresses and port numbers that need to be forwarded to your Sure Signal's internal IP address. For instructions on how to do this, we recommend you contact your ISP or Router Manufacturer, or refer to the default guide for your particular make and model, over at http://portforward.com.

Destination IP Addresses:

• 183.133.177
• 183.133.178
• 183.133.179
• 183.133.181
• 183.133.182
• 183.131.128/26

Ports and Protocols:

• 8 – TCP/UDP                 (All routers)
• 50 – TCP/UDP               (All routers)
• 53 – TCP/UDP               (Virgin Super Hubs)
• 67 – UDP                      (Virgin Super Hubs)                                                    
• 68 – UDP                      (Virgin Super Hubs)                                        
• 123 – UDP                    (All routers)     
• 500 – UDP                    (All routers)     
• 1723 – TCP/UDP           (BT Home Hubs)          
• 4500 – UDP                   (All routers)     
• 33434 – 33445 – UDP    (Virgin Super Hubs)

Please note that in the above list of IP addresses, the notation "212.183.131.128/26" means the complete range of IP addresses between 212.183.131.128 and 212.183.131.191

Your router also needs to assign the Sure Signal with a DNS (Domain Name Server) address via DHCP (Dynamic Host Configuration Protocol).

If you’re still having problems after following this, please get back to us with

• Your speed test results from here.
• Your ping test results from here.
• Your external IP address from here.
• The results of a traceroute.

VSS Traceroute command

On a PC:

1. Click on Start and select Run
2. Type CMD into the Run box and press enter/click ok
3. A black box will appear.
4. In this box type tracert 212.183.133.177 press Enter
5. Paste the output of this command into your reply.

[TK2NETADMIN]

hi,

Our firewall is open to our exernal DMZ, so forwarding all I.P's and ports.

Details of the test results below;

speed test results:

Download - 36.88mb/s
Upload - 65.39 mb/s

Ping test

Loss = 0%
Ping = 22ms
Jitter = 24ms

External I.P = 77.67.48.220

Traceroute:

Tracing route to 212.183.133.177 over a maximum of 30 hops

1 1 ms 1 ms 1 ms 77.67.48.193
2 7 ms 10 ms 9 ms ge-4-2-7-490.lon10.ip4.gtt.net [141.136.104.105]
3 8 ms 9 ms 8 ms xe-2-0-1.lon11.ip4.gtt.net [89.149.185.225]
4 9 ms 6 ms 6 ms ae9-xcr1.lns.cw.net [195.2.22.217]
5 * * * Request timed out.
6 * * * Request timed out.
7 * * * Request timed out.
8 * * * Request timed out.
9 * * * Request timed out.
10 * * * Request timed out.
11 * * * Request timed out.
12 * * * Request timed out.
13 * * * Request timed out.
14 * * * Request timed out.
15 * * * Request timed out.
16 * * * Request timed out.
17 * * * Request timed out.
18 * * * Request timed out.
19 * * * Request timed out.
20 * * * Request timed out.
21 * * * Request timed out.
22 * * * Request timed out.
23 * * * Request timed out.
24 * * * Request timed out.
25 * * * Request timed out.
26 * * * Request timed out.
27 * * * Request timed out.
28 * * * Request timed out.
29 * * * Request timed out.
30 * * * Request timed out.

Trace complete.

[Retired-Charles]

@TK2NETADMIN - Your IP address wasn't on the whitelist so I've requested this to be added.

This can take up to 24 hours.

[TK2NETADMIN]

Hi, 

Thanks for this confirmation. It's been 23 hrs and tracert is still dying at 195.2.22.217. Can yon confirm if the whitelist has now been updated? 

[Retired-Charles]

@TK2NETADMIN - We've had confirmation that it's now been added, restart your router if the Sure Signal does not activate straight away.

[TK2NETADMIN]

Hi,

I can confirm that the above update appeared to work back in January. However I've been advised that since approximately Feb, the Sure Signal V3 device has been failing to connect again. 

I've just completed the standard diagnositic checks output below: 

Download Speed: 86.81Mbps

Upload Speed: 77:41Mbps

Jitter: 5ms

External I.P address: 77.67.48.220

As before, traceroute is dying at 195.2.22.217.

LEDs on the Sure Signal device initially show a solid Red Power light, with a flashing Internet light. Periodically the device will reload. 

Please note our firewall is fully open.

[Retired-Charles]

@TK2NETADMIN - I've checked your Sure Signal and the lights that you're seeing. The description reads as follows:

Poor ISP or local network performance has been detected. Service is provided, but performance may be affected.

You'll need to verify your own network performance (the traceroute you've provided shows evidence of issues).

You'll need to escalate poor performance to you ISP.

[TK2NETADMIN]

Hi Charles,

We have no impedence to any other aspect of network performance.

Please note the traceroute terminates at 21 as I manually ended the trace once it became apparent it was not going to progress past 195.2.22.217 which I believe is a vodafone device. 

Note, I am also unable to ping vap.vodafone.co.uk.

Are you able to confirm where a successful traceroute should terminate and whether ICMP to 212.183.133.177 should be successful?

Also, are you able to verify if the firewall whitelisting previously put in place for our external I.P address is still active? 

[online999]

The range 77.67.48.220-77.67.48.255 is whitelisted

Can you make sure that the DNS is working for the vodafone address below.

From a PC plugged into the same port the SS was using, open a command prompt and do the following:

nslookup initial-ipsecrouter.vap.vodafone.co.uk

This is the first point the SS will contact, so your DNS server needs to resolve this and forward to the SS unit.

After that it will start to initiate a connection through the firewall where the definition of the address range above has to be opened, its at that point your ports need to be opened.