Issues using 887 when authenticating with MER on a Fibre connection

[chris_f_uk]

Hello All


I've been battling for a week now to get the config correct for Cisco 887VA.

I understand Sky use MER to authenticate, however, in order to create the PPP connection, I am using PPPoE without passing any authentication, other than the username|password through option 61 (and vendor information on option 60).

I have Wiresharked the provided Sky router SR102 to obtain DHCP option 60 and 61 information and have entered these as hex values in the dialer interface.

I have also spoofed the SR102 MAC address on the dialer interface.

I have created a sub interface on e0, using dot1q to tag traffic to VLAN 101

I can indeed see traffic on interface e0.101 but the dialer receives NO ip address.

I can also see the modem is connected and in sync.

Am I correct in assuming the e0.101 interface is equivalent to the WAN connection on a seperate modem?

Config is below - please ignore local IPs, etc

version 15.1
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname ******-ADSL
!
boot-start-marker
boot-end-marker
!
!
no logging buffered
enable secret 5 *********
!
aaa new-model
!
!
aaa authentication login default local
aaa authorization exec default local
!
!
!
!
!
aaa session-id common
!
memory-size iomem 10
clock timezone BST 0 0
clock summer-time BST recurring last Sun Mar 2:00 last Sun Oct 3:00
crypto pki token default removal timeout 0
!
crypto pki trustpoint TP-self-signed-1112313640
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1112313640
revocation-check none
rsakeypair TP-self-signed-1112313640
!
!
crypto pki certificate chain TP-self-signed-1112313640
certificate self-signed 01 nvram:IOS-Self-Sig#1.cer
ip source-route
!
!
!
!
!
ip cef
ip domain name vdsl.******.net
ip name-server 8.8.8.8
no ipv6 cef
!
!
multilink bundle-name authenticated
!
!
archive
log config
hidekeys
username admin privilege 15 secret 5 *********
!
!
!
!
controller VDSL 0
!
no ip ftp passive
ip ssh authentication-retries 5
ip ssh version 2
!
!
!
!
!
!
!
interface Ethernet0
no ip address
!
interface Ethernet0.101
encapsulation dot1Q 101
pppoe-client dial-pool-number 1
!
interface ATM0
no ip address
shutdown
no atm ilmi-keepalive
!
interface FastEthernet0
no ip address
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
no ip address
!
interface Vlan1
ip address 1.1.1.1 255.255.0.0
ip flow ingress
ip flow egress
ip nat inside
ip virtual-reassembly in
!
interface Dialer1
mac-address ****.****.**38
mtu 1492
ip dhcp client request classless-static-route
ip dhcp client client-id hex <<HEX STRING>>
ip dhcp client class-id hex <<HEX STRING>>
ip address dhcp
no ip redirects
no ip proxy-arp
ip flow ingress
ip nat outside
no ip virtual-reassembly in
encapsulation ppp
ip route-cache policy
dialer pool 1
dialer-group 1
ppp ipcp dns request accept
ppp ipcp route default
ppp ipcp address accept
no cdp enable
!
router ospf 1
router-id 1.1.0.1
network 1.1.0.1 0.0.0.0 area 0
default-information originate
!
ip forward-protocol nd
ip http server
ip http access-class 1
ip http authentication local
ip http secure-server
!
ip flow-cache timeout inactive 10
ip flow-cache timeout active 5
ip flow-export version 9
ip flow-export destination 1.1.1.1 9991
ip flow-export destination 1.1.1.1 9991
!
ip nat inside source list NATACL interface Dialer1 overload
!
ip access-list standard NATACL
permit 1.0.0.0 0.255.255.255
!
logging esm config
access-list 1 permit 1.0.0.0 0.255.255.255
dialer-list 1 protocol ip permit
!
!
!
!
!
!
!
control-plane
!
banner motd ^CCCCCCCCC




*****************AUTHORISED USERS ONLY*****************
^C
!
line con 0
password 7 ***************
line aux 0
password 7 ***************
line vty 0 4
session-timeout 10
exec-timeout 0 0
timeout login response 300
transport input ssh
!
scheduler max-task-time 5000
end


Many thanks

[spoofneted]

Chris,

Just wondering if you managed to get anywhere with this, or just gave up? I'm a Sky Fibre user, sadly using the bundled "Sky Hub" (aptly named, as I consider "Layer 1 Network Hubs" to be just as gash as this ), and have battled with the MER DHCP-based authentication before.

Previously, I was experimenting using a Cisco Linksys E2400 (or E4200, I forget) running Tomato USB Firmware and was getting frustrated with the hex settings.

I notice in your configs you posted the following strings, which look like they are trying to send the DHCP Vendor ID/Options that MER needs:

ip dhcp client client-id hex <<HEX STRING>>
ip dhcp client class-id hex <<HEX STRING>>

For your specified <<HEX STRING>> were you also appending the necessary "0x3d" (61) to your custom-generated User+Pass hex (i.e. full string reads "0x3d<<USER+PASS HEX>>")?

Sources as below, but curious if this could fix it?

Sources
http://www.skyuser.co.uk/forum/technical-discussion/46464-skys-mer-why-does-not-work-other-routers-22.html
https://www.cm9.net/skypass/index.cgi