Struggling to get Hey Broadband to connect over PPPoE

Hey there, I know there are some seriously knowledgable network types in here so hoping I might get a steer in the right direction as Hey Broadband have been useless.

We’ve had Hey FTTH run in, and I asked for their bridge mode kit so they installed an Adtran SDX611 GPON ONT (they also provided an Adtran 854 but as the whole plan is to use my existing network setup, this is still in the box).

I’m using a Ubiquiti Dream Machine Pro as my router, which has been absolutely fine with the previous Virgin Cable service into its WAN1 port.

We have three happy green lights on the ONT: https://share.cleanshot.com/8CTNjB3J

After much back and forth I eventually found someone in Hey that was able to provide me with PPPoE login details, but I can’t get the connection to work.

Here’s how I’ve configured the Hey WAN connection on the router: https://share.cleanshot.com/M7BQz8yN

Looking at the logs on the router, I never get any further than what appears to be the start of a PPPoE connection before it’s terminated: https://share.cleanshot.com/BhV5xzJx

UDM-Pro pppd[19558]: PPP session is 51448
UDM-Pro pppd[19558]: Connected to c4:ad:34:ed:86:9a via interface eth8
UDM-Pro pppd[19558]: Using interface ppp0
UDM-Pro pppd[19558]: Connect: ppp0 <--> eth8
UDM-Pro pppd[19558]: Connection terminated.

(what is a bit curious is the MAC starting c4 mentioned here has stayed the same even though they've replaced the ONT modem, but perhaps that's the MAC of the internal unifi router connection)

The engineer suggested I tried VLAN 10 or 20 but that doesn’t even get as far as a PPP session being started in the logs. I get errors like "pppd[19558]: Timeout waiting for PADO packets"

The Hey tier 2 support (who are seemingly a bit useless), say they’ve set everything up correctly at their end. The local engineer has replaced the ONT modem once already, and we’ve had tier 2 reset the PPPoE password a couple of times.

I have also tried making a PPPoE connection direct to the ONT from both a MacOS and Windows machine with no more success… the Mac just hangs at ‘Connecting…’ and the Windows 11 machine gives me ‘Authentication failed’.

With a bit of googling I see suggestions online that conceivably the ONT could be locked to only accept connections from a particular MAC address and for whatever reason that hasn’t been configured by tier 2 to match my router. I have MAC spoofing options in the router settings but no one can tell me what address it might be locked to.

Bit at my wits’ end as Hey keep saying ‘it’s all working at our end’ despite nobody being able to make a PPPoE connection from my house. The only time the Hey connection worked was when very first installed using the Adtran 854, before they re-provisioned the ONT into bridge mode.

Any ideas? I’m not going mad, am I? The PPPoE should just connect and hand out an IP address immediately?

Edited by edmoore (Tue 07-Mar-23 12:58:34)

In reply to a post by edmoore:

(what is a bit curious is the MAC starting c4 mentioned here has stayed the same even though they've replaced the ONT modem, but perhaps that's the MAC of the internal unifi router connection)

I would take a guess that c4:ad:34:ed:86:9a isn't the ONT but is Hey Broadbands gateway where the PPP session terminates.

It's pretty normal to lock the ONT to the OLT but not so common to lock the ONT to a router.

Hopefully someone with Hey can advise you a bit better.

Have you ever had this connection working? Does it work if you connect the router they supplied?

Yeah, the guys that did the install had the Hey supplied wifi router up and running with excellent internet performance. It’s just the bridge mode config that’s an issue. And obviously I don’t want to use their [censored] supplied router when I’ve got a load of unifi APs and decent router installed already.

Plug the WAN port of the router into your PC and packet capture it, that will give you a VLAN tag if there is one, and a MAC address to clone.

The WAN port of the ONT? Thanks will give that a go.

No the Adtran router that you said works when connected to the ONT.

Yes it's the MAC address of the router you want.

Even better: if you have access to a managed switch with port mirroring capability, you can connect router and ONT to the switch, and laptop to the mirror port, and *inspect* the traffic going back and forth between the router and ONT using wireshark or tcpdump.

So I've tried packet sniffing the ethernet connection to the ONT from my Macbook whilst trying to do a PPPoE connection and I get the following: https://share.cleanshot.com/WsJscCB4

Case closed that they've just supplied me the wrong username and password?

OK, tried this, searching wireshark for VLAN gets me this result: https://share.cleanshot.com/msgVqqWF

Looks to me like it's tagged VLAN20, I've just tried this in the router settings along with spoofing the MAC 00:23:6a:fc:e8:f0 which is the Adtran 854... this just gets me the following in the router logs:

2023-03-07T16:19:02+00:00 UDM-Pro pppd[20083]: Timeout waiting for PADO packets

Well, this is always an annoying resolution to a problem but... it just started working.

Hadn't changed anything at my end so presumably it all just took longer to provision than they thought. Thanks all for advice!

Oh wow, are they using Mikrotik? Or is that your equipment?

Glad it worked out eventually.

You did the right thing in testing the PPPoE using a laptop, as ISPs are usually tempted to blame a bad user configuration when using your own router in place of any ISP supplied kit, unless they are willing ot look at logs or captures.

We do the same kind of thing with fixed IP leased lines when the supplier says it has gone live and before connecting our router.

In reply to a post by edmoore:

Well, this is always an annoying resolution to a problem but... it just started working.

Hadn't changed anything at my end so presumably it all just took longer to provision than they thought. Thanks all for advice!

Maybe the Hey system did not like the change of MAC address at your end,