Draytek 2820, HG612, Sky Fibre and X-Kryptor

I have a Draytek 2820 running beta firmware (for DHCP options 60/61) so that it can authenticate with Sky via a HG612 modem (which is connected to WAN2). This configuration has worked very well ever since set it up (18+ months ago - after taking a while to get it working), and previously the 2820 worked perfectly with Sky LLU.

However, for work, we are forced to use the rubbish remote connectivity solution from Barron Mccann called X-Kryptor. I have noticed over the last 5 months that my X-K based connection will drop out (pinging a device at work times out for 5-10 pings), and then it generally recovers. Other devices on my home network seem to retain their access to the internet at the same time, so I don't believe that actual connection has a whole is dropping out. Prior to this, the XK solution seemed to be pretty stable.

Having complained repeatedly at work about this, I was given a second laptop (HP vs the original Dell). This also drops out, pretty much at the same time as my normal machine does (although sometimes one fails, and then the other fails a minute later or so).

"Work" are blaming the Vigor saying it must be doing some packet inspection, which is breaking XK. To try and test this theory, I reserved an IP address based on the MAC address for my normal laptop and then popped that into the DMZ. No difference. I have also turned off pretty much all data/pack inspection options I can find.

When working from home, it is generally ok in the mornings and get worse in the afternoon (working the other Bank Holiday Friday, the connection was perfect). I don't believe there are any capacity issues in the exchange/cabinet as everything else keeps working fine. I have tried uploading/download multiple GBs of data from work (generally ISO files), and it seems that "loading" my connection doesn't seem to have any affect.

Both machines were connected via a TP-Link Gig switch and that in turn to the Vigor (via a SamKnows Broadband monitoring unit). The main laptop is now hardwired direct to Vigor. I also see the same issues when connecting via WiFi.

This is really starting to hack me off. I could replace my router with another one, but that means shelling out a lot of cash to replace something which may or may not be faulty. This morning I switched back to my Black Sky Router and that just sat with a yellow unhappy "interface" face even if I left it for a good 30 minutes, and failed to 'self heal' itself.

Thanks,
Matt

Edited by mbames (Tue 28-Apr-15 13:47:27)

you are connected to a VPN at work? ask how busy this is. If it were me I would check the work VPN server and see if it was running hot. It could be they are starting to see problems there and you are the first to see it.

X-Kryptor seems to use a hardware client connected to the remote PC. This could have developed a fault but as you had no problems on a bank holiday it sounds like a capacity issue at head office. It's possible that with more remote workers having fibre, they can now saturate the office connection.

Edited by caffn8me (Tue 28-Apr-15 20:49:19)

Colleagues, who are working remotely at the same time as me don't seem to get disconnected when I do.

I agree it might seem like it was overloaded, but the networks guys at work say there are no issues their end (and at some point, I don't know when, the capacity of the pipes servicing the XK units were increased). Today, both laptops would drop off at exactly the same time (standard company build), one just loaded up with the core company stuff, and the other with all my dev tools. When the connection is up, I can happy shift about GBs of data. The disconnects appear to be totally random - not relating to me doing/running a specific process or running a network intensive application.

I am sort of thinking it is something to do with my setup, possibly some content/packet scanning in vigor, but I have pretty much disabled everything I can find (but that doesn't explain why a BH was fine). Hence trying to go back to the original Sky router, but that just seems to be borked now!

Edited by mbames (Tue 28-Apr-15 22:49:07)

What about your Samknows box? The description says;

In reference to www.samknows.com/meet-the-whitebox:

Users of the Whitebox connect it to their home router and it will run tests according to a predefined testing schedule applicable to that country and/or ISP.

But don't worry, it will only run measurements when the user is not using their home connection.

Perhaps it's not seeing the VPN traffic and launching tests when you're connected.

Good point, I'll try removing the SamKnows box for a few days, although that has been installed since before I switched to fibre, and long before the XK problems.

Certainly no harm in physically ruling it out. I knew it was meant to only run tests when it detected no other activity (wired, or wireless), so was taking it at its word.

Removed the SamKnows box, problem still exists.

Fired up a syslogger, and these messages did crop up (but not for every disconnection)

150 2015-05-01 10:25:21 May 1 09:25:15 Vigor WLAN_DBG - EAPoL_handler, from 74:86:7a:69:ce:9f
150 2015-05-01 10:25:21 May 1 09:25:15 Vigor WLAN_DBG - WLAN_DBG - EAPoL_handler: EAPOL frame from an unknown/blocked client???
150 2015-05-01 10:25:25 May 1 09:25:20 Vigor Local User (MAC=74-86-7A-69-CE-9F): 192.168.100.201:44571 -> 192.150.204.106:50000 (UDP)
150 2015-05-01 10:25:26 May 1 09:25:20 Vigor WLAN_DBG - EAPoL_handler, from 74:86:7a:69:ce:9f
150 2015-05-01 10:25:26 May 1 09:25:20 Vigor WLAN_DBG - WLAN_DBG - EAPoL_handler: EAPOL frame from an unknown/blocked client???
150 2015-05-01 10:25:26 May 1 09:25:21 Vigor Local User (MAC=74-86-7A-69-CE-9F): 192.168.100.201:44571 -> 192.150.204.106:50000 (TCP)
150 2015-05-01 10:25:31 May 1 09:25:25 Vigor WLAN_DBG - EAPoL_handler, from 74:86:7a:69:ce:9f
150 2015-05-01 10:25:31 May 1 09:25:25 Vigor WLAN_DBG - WLAN_DBG - EAPoL_handler: EAPOL frame from an unknown/blocked client???


I find it rather odd as the MAC address quoted is the NIC, which is what I am connectiung via rather than the wireless card (which is disabled by policy & by the switch on the laptop), however the WLAN suggests to me that the router believes it is doing something by wifi (unless someone just c**ked up the syslog message descriptions)

It's perfectly possible that the Draytek syslog is wrong. In one firmware iteration I used, syslog failed to record the username of anyone logging into the router which is a bit of an oversight.

Thanks

I've passed the details to Draytek (via a support ticket). At the moment they are saying I should apply the latest firmware, but sadly that removes the enhanced DHCP options I need for logging in with Sky.

It is looking increasingly like I am going to end up with another Draytek doorstop

I do also see a lot of:
DSL: DSL Rebooting... DSL Rebooting... IPLM

appearing in the WAN logs, although I am assuming it isn't relevant, as the DSL side of things is handled by the HG612, but the draytek is continually trying to connect via its ADSL port (and WAN1 is disabled)

Edited by mbames (Fri 01-May-15 13:18:07)

Eventually got to the bottom of this.

The SysLogging in the 2820 is broken, and Draytek have refused to support the device as it out of support (ie. a couple of years old).

Have flashed the firmware on the HG612 and all is good in that respect. Employer have finally admitted after 6 months that their remote connectivity solution is a bit broken, but they aren't really sure why.

Basically I still have an unstable work connection, but I know the cause, and it isn't me

Thanks for all the help guys