PPPOE authentication with Plusnet FTTP not working

[#1]

@dave thanks for your help.

I'll update everyone when I have an update, I had quite a successful and promising call with one of PAN's engineers so we shall see!!?

[#2]

Hi have you had any updates from Palo alto?

[#3]

Hi @witherford Et al,

Sorry I've not been in touch sooner,i was waiting for a few more details as I only have half a story at the moment. PAN have confirmed they will fix this. There will be a CLI option to stop it sending the EOL tag. This will come as a PANOS update.

When they confirm the commands and what version it will be present from I'll update you all again.

Cheers

[#4]

Excellent, thanks for the all the hard work pushing this, sounds promising. When you have the commands I can share them internally in case anyone else has the same issues.

[#5]

Joyous news!

We have two shiny new CLI commands in the following PAN-OS releases, note the releases below are confirmed as to which build the commands will be present from. TBC just indicates the release dates have not been confirmed. These commands will be present going forward so the versions below are just the earliest they will be present from

11.1.0 - TBC

11.0.3 - TBC

10.2.6 - TBC

10.1.11 - 7/9/23

set system setting pppoe-dont-send-eol enable no interface ethernet1/2
set system setting pppoe-dont-send-eol enable yes interface ethernet1/2

If anything changes I'll update you all otherwise I'll update you on the 7/9/23 once I'm patched to 10.1.11!

Want to say thanks to 2 people particularly for getting us this far:

@dave I'm fairly sure this wouldn't have been possible without your help and work with BTW/OR so thankyou again.

The Palo Alto Core Systems Engineer who contacted me out the blue and ran with this! I won't name you as you were super helpful and don't want you getting hounded by people fed up with T1 and T2 who had me checking route tables and rules to fix this!

[#6]

Superb result. Kudos @pauser @dave and the Palo Alto Team (individual? 😉)

I love it when a thread like this comes to fruition.

[#7]

Excellent, this is great news. I've passed the thanks on to the BTW and Openreach people.

[#8]

Ladies and Gents.

I've had an update on dates, not ideal news but not the end of the world:

11.1.0 - TBC

11.0.3 - 28/9/23

10.2.6 - TBC

10.1.11 - 21/9/23

As before I'll update this thread with either dates as and when I get them or with news once I've patched my 440!

Cheers

[#9]

---

@bobpullen wrote:

Superb result. Kudos @pauser @dave and the Palo Alto Team (individual? 😉)

I love it when a thread like this comes to fruition.

---

Bob loves it when a plan comes together with the Alto Team

[#10]

Not had an email to say 10.1.11 is available and I've just checked the firewall interface and it's not there either yet, I'm assuming it's 21/9 California time so their day is young (11:30am)! Will update when I see it, hopefully by tomorrow morning. If nothing I'll reach out to our UK contact and go from there

[#11]

Not been able to get hold of anyone at Palo today, we got a new guy as month or so ago, emailed him yesterday and today to try and get a update and didn't hear anything. Got in touch with the original guy and got his out of office but he's back on Monday so maybe an update then.

[#12]

So heard back from PAN.

The new ETAs are as follows. Not great if your not on or willing to go to 10.1.x but could be worse. I've been told the delays are likely because of the BGP DoS vul recently disclosed hence the h2 releases last week. Any who, onto the news you actually want!

10.1.11 - ETA 28/9 (This Thursday)

10.2.8 (Note the version push) - No ETA  (10.2.6 is due on the 28th too so could be a while!)

and for those of you who like life on the edge:

11.0.3 - ETA 19/10 

[#13]

Glorious news!

10.1.11 has landed 'early'! 

I've tested it and it works, the connection came up on my test device, got a public IP address and everything!

The command has changed since I last posted, the new command is 

set system setting pppoe-dont-send-eol enable <yes|no> interface <pppoev4-interface>

for example on my test box it's

set system setting pppoe-dont-send-eol enable yes interface ethernet1/3

There are 2 new log entries in the system log once you run the command:

Not adding EOL tag to PPPoE PADI packet on interface: ethernet1/3

Not adding EOL tag to PPPoE PADR packet on interface: ethernet1/3

Hope this helps!

[#14]

Awesome news! Really glad to see this working and thanks for pushing with Palo Alto.

[#15]

I can confirm on a PA-220 running software version: 10.1.11.1 that I can authenticate to the FTTP network, obtain an IP address, and access the internet.

My settings are:

CLI command entered for the PPPOE removal of EOL tag:
set system setting pppoe-dont-send-eol enable yes interface (your ppoe enabled ethernet interface)

IPV4 type:
PPPoe

General:

Enable box checked

Advanced menu Authentication:
None

Advanced menu static address:

None

Automatically create default route pointing to peer box is checked

Thanks to everyone for their continued efforts.