Cisco 877 Blocking Google Play Store & Other Android Apps

[nathan.kingston]

Hello

Currently i cannot use many android apps online, including the Play Store & Spotify.

My desktop, laptop & other network equiptment work fine.

This problem only seems to affect mobile devices.

http://i42.tinypic.com/dvk3fd.jpg

They work via the mobile networks and other wi-fi networks. Its not the wireless as i put in a cheap TP-Link modem and it works straight away.

So it boils down to my Cisco 877

I have upgraded my IOS Software and ADSL Firmware to the latest possible for my model in hope that it would help, but it hasnt.

Its a 128MB/24MB

c870-advsecurityk9-mz.150-1.XA5.bin

adsl_alc_20190_6.0.010.bin

Heres my Running-Config: http://pastebin.com/4atDVJrV

Any help would be greatly appreciated. Surley theres somthing in my config thats stopping it from working.

Thanks.

[antonio.guirado]

I recomend you capture traffic from you PC and from mobiles. Create a port-mirror in some special port

an use wireshark for example. After this, compare the captures or if you wan post them to analyze.

Regards.

[cadet alain]

Hi,

where is the AP and how is it linked to the router ?

Regards

Alain

Don't forget to rate helpful posts.

[nathan.kingston]

@antonio.guirado: I have used a simmilar tool that acted as a proxy and it allowed traffic to pass, it was using ports 80, 443, and 5228 if i recall correctly, however ill also try wireshark soon.

@cadet alain: http://i41.tinypic.com/33zd189.jpg Everything is connected to a central switch

Cisco 877 is my Modem, Router, Firewall.

Apple AirPort Extreme is my Access Point.

Synology DS1010+ is my DHCP, RADIUS, SYSLOG amongst other things.

[antonio.guirado]

Could you check the "show ip nat translation" output while trying to access from the mobile?. You should see

TCP connections and entries in the output from the mobile ip address.

Regards.

[nathan.kingston]

It appears to be DNS, 443, 5228 and 80

udp 122.149.212.174:14274 10.0.0.43:14274       8.8.8.8:53            8.8.8.8:53

udp 122.149.212.174:14352 10.0.0.43:14352       8.8.8.8:53            8.8.8.8:53

tcp 122.149.212.174:33300 10.0.0.43:33300       31.13.68.16:443       31.13.68.16:443

tcp 122.149.212.174:33523 10.0.0.43:33523       74.125.141.188:5228   74.125.141.188:5228

tcp 122.149.212.174:34974 10.0.0.43:34974       74.125.142.188:5228   74.125.142.188:5228

tcp 122.149.212.174:38042 10.0.0.43:38042       31.13.75.17:443       31.13.75.17:443

tcp 122.149.212.174:39418 10.0.0.43:39418       50.17.239.114:443     50.17.239.114:443

tcp 122.149.212.174:42290 10.0.0.43:42290       31.13.68.16:443       31.13.68.16:443

tcp 122.149.212.174:45323 10.0.0.43:45323       23.21.220.40:443      23.21.220.40:443

tcp 122.149.212.174:46896 10.0.0.43:46896       74.125.237.110:80     74.125.237.110:80

tcp 122.149.212.174:46985 10.0.0.43:46985       54.225.174.247:443    54.225.174.247:443

tcp 122.149.212.174:50122 10.0.0.43:50122       50.19.108.118:443     50.19.108.118:443

tcp 122.149.212.174:52656 10.0.0.43:52656       107.21.236.168:443    107.21.236.168:443

tcp 122.149.212.174:53661 10.0.0.43:53661       54.225.174.247:443    54.225.174.247:443

tcp 122.149.212.174:53954 10.0.0.43:53954       74.125.237.103:443    74.125.237.103:443

tcp 122.149.212.174:57948 10.0.0.43:57948       31.13.68.16:443       31.13.68.16:443

tcp 122.149.212.174:58330 10.0.0.43:58330       193.182.8.28:80       193.182.8.28:80

tcp 122.149.212.174:58346 10.0.0.43:58346       31.13.68.16:443       31.13.68.16:443

tcp 122.149.212.174:58547 10.0.0.43:58547       74.125.237.103:443    74.125.237.103:443

tcp 122.149.212.174:58877 10.0.0.43:58877       107.21.103.249:443    107.21.103.249:443

tcp 122.149.212.174:59241 10.0.0.43:59241       50.16.199.37:443      50.16.199.37:443

tcp 122.149.212.174:60434 10.0.0.43:60434       74.125.237.103:443    74.125.237.103:443

tcp 122.149.212.174:60478 10.0.0.43:60478       74.125.237.115:80     74.125.237.115:80

[nathan.kingston]

I just ran the phone via a proxy and rebooted it then opened the app store (which works via the proxy). This is what traffic it reported.

http://i44.tinypic.com/5u35e0.png

[antonio.guirado]

I think that it is time to wireshark.... If the application is "time out" something is wrong but connections are created. ??

[nathan.kingston]

My phone runs a custom rom so i was able to get a direct dump.

For both the phone has been turned off then on, shark has been started, then the play store open, then shark stopped.

This one is on the mobile network.

https://dl.dropboxusercontent.com/u/2049808/mobilenetwork.pcap

This one is Wi-Fi (when it times out).

https://dl.dropboxusercontent.com/u/2049808/wifi.pcap

[antonio.guirado · Accepted solution]

Hello,

I have studied you captures. I think is a MTU problem. If you study wifi

capture (using ip.addr == 74.125.237.110 as wireshare filter), all application data packets (packet number 334 for expample) are lost (there is no ACK). The only "thing" about this packets is that are long (near to 1500 bytes). Besides in mobile the MSS negotiated is 1394 and in wifi 1430. I do not know in which link the frame is dropped.

To be sure about that the problem please use the commad if the outgoing interface in the internet router:

ip tcp adjust-mss 1400

This command lets router forcing a MSS of 1400 bytes in every TCP negotiation. This command should not cause any problem in the rest of traffic. Please use different values 1400, 1410, and son on until you find the maximum value that

works.

Regards.

[nathan.kingston]

EDIT: It works to 1420, the rest of the tests above that were just the app cache. So i restarted the phone and started at 1460 and went down to 1420 when it started working.           

You are an absolute genious.

I used it on the Dialer0 interdace and it works all the way up to 1460.

Correct me if im wrong but is it because i have the MTU set at 1460 it was denying packets above that ?

Thank-you so much, ive spent many many hours trying to diagnose this problem.

[antonio.guirado]

I think so. There is a MTU restriction in some of your links. With the command the cisco router is able

to force a MSS (not MTU) in the TCP three-way hand-shake. Notice that is only for TCP connections.

If you have some services based on UDP the problem still will be. If you can check your MTU in your links.

Regards