SG2100 - Unable to get DHCP WAN IP on GPON interface

stealthmode

@stephenw10 hi again, thank you for your reply.

The ONU stick is running OpenWrt 14.97_ltq -- Lantiq Edition for GPON

I've been looking at the following:

https://hack-gpon.org/ont-fs-com-gpon-onu-stick-with-mac/

https://resource.fs.com/mall/doc/20230831180515egrzs6.pdf

https://medium.com/@cyayon/configure-onu-gpon-onu-34-20bi-for-orange-isp-2af4fccfc95a

https://github.com/xvzf/zyxel-gpon-sfp

Can you please clarify what do you mean by - "You may need to assign mvneta0 directly as well because traffic to the GPON module management would not normally be using a VLAN."

keyser

@stealthmode I’m using that exact combo (2100 + FS GPON ONU) so we know pfSense and the SFP module plays nice together.

Since you are seeing state 5 in onu ploamsg you are connected to the ISP’s GPON tree, and we are likely then dealing with missing or wrong pfSense config. This can be VERY tricky to troubleshoot however, as the ISP holds the keys to the kingdom.

What country and ISP are you trying to connect to? I’m using my setup in France and using Orange as the ISP.
Orange’s use of IPoE is VERY VERY strict, and requires a LOT of specific DHCP options to be configured + VLAN priority settings - otherwise they simply do no not reply to to your pfSenses DHCP REQUESTs - and nothing works.

So you need to find some way to verify what VLAN and DHCP settings is required by your ISP to accept DHCP requests.

keyser

@stealthmode said in SG2100 - Unable to get DHCP WAN IP on GPON interface:

Can you please clarify what do you mean by - "You may need to assign mvneta0 directly as well because traffic to the GPON module management would not normally be using a VLAN."

If you are certain your ISP is using VLAN 12 for their services, you do not need to assign mvneta0 to an interface unless you wish to be able to SSH to the GPON module (for status and management). Your WAN should be assigned to mvneta0.12
You could then assign mvneta0 to a OPT1 interface and give it a static 192.168.1.1/24 address. That would allow you to SSH to pfSense, and from there SSH to 192.168.1.10 (The GPON ONU)

stealthmode

@keyser Thank you very much for confirming!

I'm in Portugal and my ISP is MEO.

Let me dig through what the possible DHCP options might be.

I wanted to confirm another thing - that since I see status 5 on ONU, that means that there are no settings which need to be modified on the ONU? is that right? Basically, the ISP recognises the ONU.

keyser

@stealthmode said in SG2100 - Unable to get DHCP WAN IP on GPON interface:

I wanted to confirm another thing - that since I see status 5 on ONU, that means that there are no settings which need to be modified on the ONU? is that right? Basically, the ISP recognises the ONU.

As far as I know and understand how the GPON ONU/ONT topology works yes - The ONU is connected and logged into the GPON tree, so traffic should be able to flow. The trouble is that when the ISP is using IPoE authentication (The DHCP exchange is the authentication), no traffic will flow your way before you have authenticated. So you are likely unable to verify if traffic is flowing by doing a promiscious packet capture on your OPT1 (mvneta0) interface. But try and do it anyways - it will show any frames your pfsense sends, and if you were authenticated it would show any frames (including vlan 12 tagged ones - your WAN) inbound to your pfsense - normally broadcasts/Arp and such. Perhaps you could be lucky that they allow certain frames to pass even in unauthenticated state - thus verifying that traffic is actually flowing.

The only thing i’m a little unsure of is MAC addressing. On my ISP (Orange) it is necessecary to clone the ISPs router box MAC address to the GPON ONU - otherwise it won’t log into the GPON tree. After that connection is established (state 5) and the ONU enters bridgemode, Orange doesn’t really care about the router (pfSense) MAC address on the WAN interface. I decided to clone the router MAC address to pfSense as well. But your ISP may or may not care about the MAC address - both on the ONU side and the Router/pfSense side.

stephenw10

Do you not even see a response to DHCP requests without the correct incantation?

keyser

@stephenw10 Nope, if your DHCP frame is not formattted correctly with the required DHCP options to authenticate, then there will be no DHCP reply/offer. So you are unable to verify if traffic actually works or your VLAN tagging is correct.

On top of that my ISP - Orange - requires all DHCP frames to be priority 6 tagged as well. If they are not, no replies are made.

stephenw10

Urgh, well that's not easy then!
#funtimes

keyser

@stephenw10 Indeed - if the ISP is strict like Orange, it will be impossible to to make it work unless you have one of two options:

Someone inside info from the ISP to be able configure all the right settings.
Be able to do a packet capture of your original ISP routers DHCP exchange and mimic all settings in pfSense

In Orange’s case there is a large internet forum in france where thousands of people share their findings + a representative (unofficial I presume) from Orange shares the strict requirements their end verifies before passing authentication.

stealthmode

@keyser said in SG2100 - Unable to get DHCP WAN IP on GPON interface:

Be able to do a packet capture of your original ISP routers DHCP exchange and mimic all settings in pfSense

How should I be able to do this? any ideas?

keyser

@stealthmode not really No since your ISP is using GPON. It would require special hardware that can bridge the GPON fiber and give you a capture sitting in the middle.

If your ISP router has another WAN port (RJ45), it might work by linking that to your pfsense while doing a packet capture on the pfsense port. The ISP router might send the same crafted DHCP request on the RJ45 WAN port as it does on the GPON fiber port when linking up/booting.

Alternatively you would need an ISP router that is hacked to mirror packets to a secondary port (if possible at all on that HW).

All you need is a copy of that first DHCP request frame as that shows all options and if needed prioriry settings.

stephenw10

Mmm, but finding someone else who has already done it for your ISP would be easiest. Perhaps there is some local forum for users?

keyser

@stealthmode I’m from Denmark, but my french “connection” required me to find all the info I needed on this french site: https://lafibre.info/index.php

There is a LOT of info sharing on various ISPs on that site. Perhaps someone there have also been working with MEO if they are present in France, or if that someone has remote sites in Portugal.

keyser

@stealthmode I can see there is some discussions about ISP’s in portugal. Perhaps you can find something here:
https://lafibre.info/europe-sud/

stealthmode

@keyser said in SG2100 - Unable to get DHCP WAN IP on GPON interface:

https://lafibre.info/europe-sud/

Thank you very much! I'm enquiring on this forum as well as other forums for this ISP

stealthmode

Great news! I logged into the CLI of the router and was able to capture some additional details on the WAN interface.

Interface:                     erouter0
MAC Address :                  <removed>
Description:                   Interface_erouter0
Type:                          IPoE
Vlan 802.1p:                   0
Vlan Mux ID:                   12
Vlan TPID:                     0x8100
IPv6:                          Enabled
IGMP Proxy:                    Enabled
IGMP Source:                   Enabled
MLD Proxy:                     Disabled
MLD Source:                    Disabled
NAT:                           Enabled
NAT Type:                      Masquerade
Firewall IPv4:                 Enabled
Firewall IPv6:                 Enabled
Force Disable Firewall IPv4:   Disabled
Force Disable Firewall IPv6:   Disabled
ARPPing:                       Enabled
ARPPing timeout(secs):         900
ARPPing number of repetitions: 3
Status:                        Connected
IPv4 address:                  <removed>
IPv6 address:                  <removed>
Enable/Disable:                Enabled
Addressing Type IPv4:          DHCP
------DHCPv4------
Option 60 Vendor ID:           meods00
Option 61 IAID:
Option 61 DUID:
Subnet Mask:                   <removed>
Default Gateway:               <removed>
Option 125:
DNS Servers:                   <removed>
Remaining Lease Time(secs):    <removed>
------DHCPv6------
Type:                          PrefixDelegation
Prefix:                        <removed>/56
Preferred lifetime:            90000
Valid lifetime:                90000
Default gateway:               <removed>
DNS Servers:                   <removed>
----------------------------------------------

Considering the above, I need to set Option 60, and also set the DHCPv6 options. Do you think that there are any other settings I should configure on the WAN interface?

thank you

keyser

@stealthmode VendorID might be the only setting needed - it might not. Sometimes not everything is outputted in Shell command like that. But try

stephenw10

Mmm, what did you run to get that? I can't decide if that's what the server sent rather than the client.

stealthmode

@stephenw10 The router has a banner

"RDK (A Yocto Project based Distro) 2.0 GEN8"

I ran cd wan and then show

I've configured the PFSense wan interface in this way

On mvneta0.12 WAN interface, enabled Advanced Configuration and Configuration Override
Set the file as "/root/dhcp-config/dhcp.conf"
The file contents are the following:

interface "mvneta0.12" {
      timeout 60;
      retry 15;
      select-timeout 0;
      send dhcp-class-identifier "meods00";
}

Restarted PFsense
still don't appear to be getting the WAN IP

Do you think my configuration is correct here?

keyser

@stealthmode Probably, but it’s hard to tell if your setup works as intended unless you do a packet capture.

I would instead not enable configuration override, and just insert:

Dhcp-class-identifier “meods00”

In the send options dialog. Then we know it will be included in the standard DHCP process from pfSense (it will also be fully restorable from a config file if you ever reinstall or move to a different device)