weird issue with VLAN 0 tagging on the WAN port

[Dzha2000]

Hello,

Maybe someone can help me with very weird issue I’m having with my UCG-Fiber.

I have AT&T at my house (BGW210 gateway) and a newly purchased UCG-Fiber. I have very carefully followed the guide for wpa_supplicant bypass and actually able to authenticate with ATT and surf the internet if I do it a certain way.

The issue is this:

1. When I reboot my UCG and tagging with VLAN 0 is enabled, I cannot surf the internet at all, no ping as well.
2. When I reboot the UCG and I do not tag the WAN port with any VLANs, I see this weird behavior where I can ping the sites by IP and name, I can traceroute, I can even partially load the webpage (background and some text) but the webpages would never properly or completely load.
3. If I reboot the UCG and do not specify VLAN tag on the WAN port and wait until it fully boots and then go to the WAN interface and specify VLAN 0 (like outlined in the wpa_supplicant bypass guide) it fixed the issue. I can browse the internet with no issues at all.
4. If I reboot the UCG after getting internet working in step 3, I lose the internet and get back to step one where VLAN 0 Tagging on the WAN interface is enable and I get no surf at all.

The way it feels that when WAN port is tagged with VLAN 0 during boot it will fail authentication completely. When WAN port is not tagged with VLAN 0 I'm able to do authentication to ATT but I can't browse until I enable VLAN tagging on the WAN port.

Has anyone seen anything like that before? It feels like there is some weirdness that is going on UCG side with the VLAN 0., but I can’t put my finger on it.

Any help will be appreciated.

[jerrywilborn]

I had a similar situation to you, here's my setup and my (working) configuration. Using VLAN ID of "0" resulted in wpa_supplicant reporting success but no traffic would pass (DHCP requests went unanswered).

Previously: Ciena 3903x -> BGW320-505 -> USG 3P
Now: Ciena 3903x -> Cloud Gateway Max (using wpa_supplicant)

I am not using MAC address cloning, "2" for the VLAN ID, and "None" for the QOS Tag.

Here's my configuration file and certs permissions...
`
root@Cloud-Gateway-Max:/etc/wpa_supplicant# cat wpa_supplicant-wired-eth4.conf
eapol_version=1
ap_scan=0
fast_reauth=1
openssl_ciphers=DEFAULT@SECLEVEL=0
network={
ca_cert="/etc/wpa_supplicant/certs/cacerts.pem"
client_cert="/etc/wpa_supplicant/certs/client.pem"
eap=TLS
eapol_flags=0
identity="..."
key_mgmt=IEEE8021X
phase1="allow_canned_success=1 allow_unsafe_renegotiation=1"
private_key="/etc/wpa_supplicant/certs/private.pem"
}

root@Cloud-Gateway-Max:/etc/wpa_supplicant# ls -la /etc/wpa_supplicant/certs
total 20
drwxr-xr-x 2 root root 4096 May 7 11:59 ./
drwxr-xr-x 4 root root 4096 May 7 21:43 ../
-r-------- 1 root root 3958 May 7 11:59 cacerts.pem
-r-------- 1 root root 1131 May 7 11:59 client.pem
-r-------- 1 root root 887 May 7 11:59 private.pem
`

[BaDxKaRMa]

@Dzha2000 did you ever solve this issue? I'm having the same problem. I have to start with my UXG-Fiber in Auto for WAN1 then let wpa_supplicant connect. But I get less than .5 mbps. At which point, I set it to VLAN0 QOS1 and things are fine until it reconnects. At which point, I have to change it to auto, bounce the port, and start again.

[Dzha2000]

@Dzha2000 did you ever solve this issue? I'm having the same problem. I have to start with my UXG-Fiber in Auto for WAN1 then let wpa_supplicant connect. But I get less than .5 mbps. At which point, I set it to VLAN0 QOS1 and things are fine until it reconnects. At which point, I have to change it to auto, bounce the port, and start again.

@BaDxKaRMa I wish I can say that I have. No, I never was able to figure out a solid solution. I just put my UXG on a UPS and hope and pray I don't lose power. If I do, I just manually have to bounce the port until get my internet back.

One thing I never got to try is to put WAN port on a SFP port to see if that makes any difference, so if you have an SPF, give it a try.

[BaDxKaRMa]

@Dzha2000 Good news! I solved it for myself and I think it will probably solve your issue as well. I won't bother with the long version unless you need it for troubleshooting as I think we were in the same state. You just need to define the vlan id in the service. My UI config consists of VLAN 0, QOS 1, Mac Address Clone enabled.

Steps to fix

1. Remove the failing service (my wan is eth4 on the UXG-Fiber)

systemctl stop wpa_supplicant-wired@eth4
systemctl disable wpa_supplicant-wired@eth4

2. Update the configuration file to use the interface with the vlan id (0)

sudo mv /etc/wpa_supplicant/wpa_supplicant-wired-eth4.conf /etc/wpa_supplicant/wpa_supplicant-wired-eth4.0.conf

3. Start and Enable the new service

sudo systemctl start wpa_supplicant-wired@eth4.0
sudo systemctl enable wpa_supplicant-wired@eth4.0

Then you can check status or logs to see if it works.

sudo systemctl status wpa_supplicant-wired@eth4.0
journalctl -u wpa_supplicant-wired@eth4.0 -f

I've been able to reboot and everything connects fine. I haven't upgraded yet to see if things are ok but I'm sure they will be.

[Dzha2000]

@BaDxKaRMa Thank you very much. That did work.

Sorry it took me so long to try it out, I was out of country for a month.

Now, looking at the solution, it makes sense. Again HUGE thank you for helping out.