RV320 WAN port drops connection

[anthonya1]

I have an RV320 connected to a cable modem on the WAN port. every once in a while, less than a day but more than a few hours, the WAN port stops sending traffic. I tried Static and DHCP (im supposed to use DHCP but for testing I used static as well) for my ip address. when the issue occurs, I can fully access the router via the lan side and manage it. when I view the interface stats, its up, with an ip address. no traffic passes through it though, verified this many times and using different methods. when I renew the ip, it just hangs. when I release and renew it hangs and never gets a new ip. I have to down the interface or reboot and then it gets an ip and works fine. I've also tried autonegotiate and hard setting the port speed. the logs are no help, not indicating anything. previously I had an apple airport express hooked up to the connection and it worked fine for years. so I know the connection and cabling, etc is good. any ideas? im running the latest code. I have not tried the wan2 port to see if that works. thanks!

[anthonya1]

additional info. it happened again and I gathered more info. so when the interface stops passing traffic, I get a message in the log about physical sync speed or something like that. basically it is trying to autonegotiate and it either doesn't get a response or ignores it and goes into a bad state. when I check, it says negotiated at 1000GB but no packets pass through and the ip is still the same. when I release/renew it hangs permanently never getting an ip. I have to down the interface OR change it from auto to 100FULL and it comes back immediately. strange thing is, the SAME issue occurs if I hardset it to 100FULL as well. sound like a defective port?

[mdobiac]

Hello anthonya1,

Without seeing the logs my first suspicion is that something is flooding the router and the router is not responding as it either protecting the network or its buffers are full on that interface.

I would recommend setting up a syslog (though it seems like you have) and possible try to get a packet capture for traffic coming to the WAN (inbound).  Though this may show as well in the inbound log table under the logging section in the RV320W.  Look for extra amount of log entries of the same IP address either as a source or destination.

Regards,

Michael Dobiac

If this post is helpful please rate or mark as correct.

[anthonya1]

I wondered that too. primary reason I left that reasoning was that my old firewall, an apple airport express, worked fine. never lost connection, ever (that I was aware of). this does it multiple times a day. I did check anyway and didn't see anything obvious. I ran a packet capture and was a bit surprised how clean it was (for the internet). my modem is in bridge modem so I see everything at the wan port. ill attach a snippet below. thank you!

9:34:15.000 AM

Mar 13 09:34:15 firewall. kernel: WARNING: cant get external phy status

•host =  firewall.
•source =  udp:514
•sourcetype =  syslog
 
  3/13/15 
9:09:45.000 AM

Mar 13 09:09:45 firewall. kernel: WARNING: cant get external phy status

•host =  firewall.
•source =  udp:514
•sourcetype =  syslog
 
  3/13/15 
9:01:34.000 AM

Mar 13 09:01:34 firewall. kernel: WARNING: cant get external phy status

•host =  firewall.
•source =  udp:514
•sourcetype =  syslog
 
  3/13/15 
7:38:51.000 AM

Mar 13 07:38:51 firewall. kernel: WARNING: cant get external phy status

•host =  firewall.
•source =  udp:514
•sourcetype =  syslog
 
  3/13/15 
7:22:24.000 AM

Mar 13 07:22:24 firewall. kernel: WARNING: cant get external phy status

•host =  firewall.
•source =  udp:514
•sourcetype =  syslog
 
  3/13/15 
6:08:02.000 AM

Mar 13 06:08:02 firewall. kernel: WAN [2] DOWN

•host =  firewall.
•source =  udp:514
•sourcetype =  syslog
 
  3/13/15 
6:08:01.000 AM

Mar 13 06:08:01 firewall. kernel: ip[0.0.0.0] mask[0.0.0.0]

•host =  firewall.
•source =  udp:514
•sourcetype =  syslog
 
  3/13/15 
6:08:01.000 AM

Mar 13 06:08:01 firewall. kernel: ip[74.141.x.xmask[0.0.0.0]

•host =  firewall.
•source =  udp:514
•sourcetype =  syslog
 
  3/13/15 
6:08:01.000 AM

Mar 13 06:08:01 firewall. kernel: [eth0] lanip=192.168.0.1, mask=255.255.255.0

•host =  firewall.
•source =  udp:514
•sourcetype =  syslog
 
  3/13/15 
6:08:01.000 AM

Mar 13 06:08:01 firewall. kernel: WAN [2] UP

•host =  firewall.
•source =  udp:514
•sourcetype =  syslog
 
  3/13/15 
5:59:44.000 AM

Mar 13 05:59:44 firewall. kernel: WAN [2] DOWN

•host =  firewall.
•source =  udp:514
•sourcetype =  syslog
 
  3/13/15 
5:59:42.000 AM

Mar 13 05:59:42 firewall. kernel: ip[0.0.0.0] mask[0.0.0.0]

•host =  firewall.
•source =  udp:514
•sourcetype =  syslog
 
  3/13/15 
5:59:42.000 AM

Mar 13 05:59:42 firewall. kernel: ip[74.141.x.xmask[0.0.0.0]

•host =  firewall.
•source =  udp:514
•sourcetype =  syslog
 
  3/13/15 
5:59:42.000 AM

Mar 13 05:59:42 firewall. kernel: [eth0] lanip=192.168.0.1, mask=255.255.255.0

•host =  firewall.
•source =  udp:514
•sourcetype =  syslog
 
  3/13/15 
5:59:42.000 AM

Mar 13 05:59:42 firewall. kernel: WAN [2] UP

•host =  firewall.
•source =  udp:514
•sourcetype =  syslog
 
  3/13/15 
5:09:54.000 AM

Mar 13 05:09:54 firewall. kernel: WARNING: cant get external phy status

•host =  firewall.
•source =  udp:514
•sourcetype =  syslog
 
  3/13/15 
3:47:44.000 AM

Mar 13 03:47:44 firewall. kernel: WARNING: cant get external phy status

•host =  firewall.
•source =  udp:514
•sourcetype =  syslog
 
  3/13/15 
3:47:41.000 AM

Mar 13 03:47:41 firewall. kernel: WAN [2] DOWN

•host =  firewall.
•source =  udp:514
•sourcetype =  syslog
 
  3/13/15 
3:47:39.000 AM

Mar 13 03:47:39 firewall. kernel: ip[0.0.0.0] mask[0.0.0.0]

•host =  firewall.
•source =  udp:514
•sourcetype =  syslog
 
  3/13/15 
3:47:39.000 AM

Mar 13 03:47:39 firewall. kernel: ip[74.141.x.xmask[0.0.0.0]

•host =  firewall.
•source =  udp:514
•sourcetype =  syslog
 
  3/13/15 
3:47:39.000 AM

Mar 13 03:47:39 firewall. kernel: [eth0] lanip=192.168.0.1, mask=255.255.255.0

•host =  firewall.
•source =  udp:514
•sourcetype =  syslog
 
  3/13/15 
3:47:39.000 AM

Mar 13 03:47:39 firewall. kernel: WAN [2] UP

•host =  firewall.
•source =  udp:514
•sourcetype =  syslog
 
  3/13/15 
3:47:38.000 AM

Mar 13 03:47:38 firewall. kernel: WARNING: cant get external phy status

•host =  firewall.
•source =  udp:514
•sourcetype =  syslog
 
  3/13/15 
3:31:07.000 AM

Mar 13 03:31:07 firewall. kernel: WARNING: cant get external phy status

•host =  firewall.
•source =  udp:514
•sourcetype =  syslog
 
  3/13/15 
2:54:38.000 AM

[anthonya1]

so some time has passed, and I've done quite a bit of additional research. i don't see any attacks or excessive traffic, the ONLY thing is a i see my dhcp server (my ISP that is) sending a lot of requests to 0.0.0.0. my firewall blocks them all though and its not per second. i do still get a dhcp address regardless of this deny message. it takes about a day and a half, then the interface just stops passing traffic. i caught it while it was listed as connected but inactive. i set a manual ip and tried to ping just my cable modem (which always works) and it didn't! that surprised me. i was thinking it was an ISP or traffic related but this seems to indicate something on the firewall. why wouldn't the interface work once i manually set it. i disabled and reenabled it and it still didn't work. the only way i could get it to work is to change it from auto negotiate to 100/full and then back to auto. bam, got an ip and traffic flowed. sounds like a bug?

[SamirD]

Good chance that this is a bug or some sort of hardware issue.  So here's how we can find out.  Change to another firmware version (up or down) and rebuild your configuration from scratch.  DO NOT save and restore it as that in itself can cause problems.  Once you have done this, see if it has any issues.  If it's fixed, it is a software bug.  If it isn't, it could be a hardware issue.

[anthonya1]

Will do. I'm on the latest version so ill downgrade 1 version, blow it away and rebuild from scratch. should manifest in 1 to 2 days. ill work on it this week and let you know what happens. thanks for the advice!

[SamirD]

And if that doesn't work, it won't hurt to try a completely different version as it could have been a bug introduced a few firmwares ago.

[anthonya1]

so I tried different firmware and even returned it for another router. same issue. tried different firmware on that one. same issue. I reverted back to my old firewall, an apple airport express, all worked fine on the apple firewall. I have no idea at this point. I have never opened a TAC case for non-enterprise class equipment. does anyone know how to do that? im out of ideas at this point.... I love this router, it does everything I want and the price point is excellent but it just wont stay up longer than 2 days.... hopefully cisco TAC can find a bug in the code.... I cant be the only one with this issue.

[mdobiac]

Hello anthonya1,

To open a case you will need the serial number of the unit and your Cisco user ID.

And make sure you have a contract on the unit if you need 24x7 support otherwise it is Mon-Fri during your business hours  (typically 9am  -6pm in your time zone).

The support number is 1-866-606-1866.

Regards,

Michael D.

[Chet Prokop]

Looking for WAN drops, this thread matches what we've seen now at several of our installs with RV320's .... each single WAN, Comcast service, static IP.  Customers call us with "our internet connection is down". But when looking at the router locally, the static looks in place--but no Internet.  We cannot remotely access the router when this happens because it appears the WAN1 port is offline.

Rebooting the router or cable modem 'fixes' this but it is NOT acceptable to the customers.

Guys (at Cisco) we have a handful of customers that are experiencing this same issue now in Houston with Comcast biz, each static IPs.

Several have 1.1.1.19 fw and the newer installs have 1.2.1.13. Doesnt matter...same issue.

I dont see anything especially wierd in the logs other than the occasional:

"kernel: WARNING: cant get external phy status " ... which i'm not too sure about.

Is there any beta-fw patch or a fix for this. We can replace the router with a Fortigate and have zero problems. But we like the entry smb routers for these smaller customers and would like to fix this issue we're seeing.

Comments??? Options???

Chet - Houston

[WG Network Team]

Hello,

check below:

https://tools.cisco.com/bugsearch/bug/CSCuu10991/?referring_site=bugquickviewclick

[Chet Prokop]

I see your bug note. But this also happens with  1.2.1.13--latest fw available. 

I know this has to be fixable in firmware--since other routers WORK and don't disconnect and do NOT have to be restarted!

We seem to get a lot of WAN2 up and down -- even tho we have this as a single WAN1 source.  This was offline until you see the restart at the end of this:

2015-09-11, 06:36:56	Kernel	kernel: WARNING: cant get external phy status
2015-09-11, 06:45:01	Kernel	kernel: WARNING: cant get external phy status
2015-09-11, 07:18:37	Kernel	kernel: WAN [2] UP
2015-09-11, 07:18:37	Kernel	kernel: [eth0] lanip=192.168.112.1, mask=255.255.255.0
2015-09-11, 07:18:37	Kernel	kernel: ip[50.xxx.xxx.xxx(Comcast WAN IP)] mask[0.0.0.0]
2015-09-11, 07:18:37	Kernel	kernel: ip[0.0.0.0] mask[0.0.0.0]
2015-09-11, 07:18:38	Kernel	kernel: WAN [2] DOWN
2015-09-11, 07:18:44	Kernel	kernel: WAN [2] UP
2015-09-11, 07:18:44	Kernel	kernel: [eth0] lanip=192.168.112.1, mask=255.255.255.0
2015-09-11, 07:18:44	Kernel	kernel: ip[50.175.4.142] mask[0.0.0.0]
2015-09-11, 07:18:44	Kernel	kernel: ip[0.0.0.0] mask[0.0.0.0]
2015-09-11, 07:18:45	Kernel	kernel: WAN [2] DOWN
2015-09-11, 07:36:04	Kernel	kernel: nk_bcm53115_sync_speeds_phy_to_mac(): sport[5], speed[0], duplex[0]
2015-09-11, 07:36:04	Kernel	kernel: nk_bcm53115_sync_speeds_phy_to_mac(): sport[5], speed[1], duplex[2]
2015-09-11, 07:41:00	Kernel	kernel: add new: cnt[26] learn mac[0-bb-3a-32-3f-53], ip[192.168.112.159], idx[53]
2015-09-11, 07:44:08	Kernel	kernel: nk_bcm53115_sync_speeds_phy_to_mac(): sport[5], speed[0], duplex[0]
2015-09-11, 07:44:09	Kernel	kernel: nk_bcm53115_sync_speeds_phy_to_mac(): sport[5], speed[1], duplex[2]
2015-09-11, 07:52:16	Kernel	kernel: WARNING: cant get external phy status
2015-09-11, 08:16:57	Kernel	kernel: nk_bcm53115_sync_speeds_phy_to_mac(): sport[5], speed[0], duplex[0]
2015-09-11, 08:16:58	Kernel	kernel: nk_bcm53115_sync_speeds_phy_to_mac(): sport[5], speed[1], duplex[2]
2015-09-11, 08:25:08	Kernel	kernel: WARNING: cant get external phy status
2015-09-11, 08:58:36	Kernel	kernel: nk_bcm53115_sync_speeds_phy_to_mac(): sport[5], speed[0], duplex[0]
2015-09-11, 08:58:36	Kernel	kernel: nk_bcm53115_sync_speeds_phy_to_mac(): sport[5], speed[1], duplex[2]
2015-09-11, 09:15:33	Kernel	kernel: WARNING: cant get external phy status
2015-09-11, 09:40:20	Kernel	kernel: nk_bcm53115_sync_speeds_phy_to_mac(): sport[5], speed[0], duplex[0]
2015-09-11, 09:40:20	Kernel	kernel: nk_bcm53115_sync_speeds_phy_to_mac(): sport[5], speed[1], duplex[2]
2015-09-11, 10:05:00	Kernel	kernel: nk_bcm53115_sync_speeds_phy_to_mac(): sport[5], speed[0], duplex[0]
2015-09-11, 10:05:00	Kernel	kernel: nk_bcm53115_sync_speeds_phy_to_mac(): sport[5], speed[1], duplex[2]
2015-09-11, 10:15:47	System Log	TSG-RTR3-CSC320 : System is up There has got to be an answer for this. This is from one of our connections... and same at customers!

[anthonya11]

Good Luck. i opened a ticket with cisco and got no where. they were very polite and tried to help but no one REALLY understood what was going on. i eventually gave up when the specific code i found worked. See this thread. 

https://supportforums.cisco.com/discussion/12561456/only-11106-code-works

The issue is firmware and it on the RV320. i pinpointed it to how the router handles certain types of dhcp requests. I'm not a coder so i can't debug further but that IS what the issue is. no other code in the routers code tree works. it DOES seem to be specific to time warner though. I'm guessing they are using some router that functions non-standard. i used a few other models of routers and found only the cisco had the issue but i also noticed each router HAD the problem, the cisco was the only one that would not recover. when it gets a dhcp request from the upstream router, it loses connection to the internet for a short period of time. ALL the routers i tested do this. after a minute or two, they come back online (most of the time seconds). but after a few hours, the cisco stops, almost like its had too many requests to renew its ip and then just gets upset and stops renewing it. a cold boot or hard interface down/up is the only way i found to get it to work again. whatever is in that one code that works, id compare it to the others. it clearly has something different as I'm going on 2 months with no reboots on it. all other code revs fail in under 1 day....

[Chet Prokop]

... I know... but it seems if Cisco really monitors these and sees the number of rv320 intermittent wan disconnect comments and issues out there... you'd think there would be some interest in addressing.

The 320 has been a good upgrade from the 042's.. but in our smb customer space, we'd like to have the best Cisco can provide for the small biz commercial space.  This sort of thing is not only annoying but creates a real customer confidence issue for us using Cisco biz products (which we generally do 100%).  This one is rocking my confidence pretty well...