Debug PPPoE connection

[ch4071c]

Hi guys,

I need to find out why PPPoE on my FG40 is failing connection.

Using:

diag debug enable diag debug application pppoe -1 diag debug application ppp -1

is giving me nothing.

I'm connecting my fiber converter directly to the WAN interface.

The same info is being written to console all the time, but it's not giving me much useable info:

pppd 0 pppoed wan      nopersist noipdefault noauth defaultroute default-asyncmap hide-password nodetach mtu 1492 mru 1492 noaccomp noccp nobsdcomp nodeflate nopcomp novj novjccomp user MY_USERNAME lcp-echo-interval 5 lcp-echo-failure 3 sync plugin /bin/pppoe.so     pppoe_retry_time 1 pppoe_padt_time 1 pppoe_srv_name  pppoe_ac_name  pppoe_hostuniq 1423b4c0 pppoe_sock2parent 12 wan ipunnumbered 0.0.0.0 idle 0 unnumbered-negotiate enable

The WAN connection just says 'Failed'. It would be nice to see a simple error saying 'password incorrect' or something like it.

Any help is much appreciated.

[sw2090 · Accepted solution]

I remember having had similar messages in debug log when I tied to configure one of the internal lan porst of a FGT92D to be a WAN and do pppoe.

It didn't work with similar messages. We finally found out with Fortinet TAC that you must set a global option o this one to enable pppoe on an internal lan even though gui lets you configure the port for pppoe without that set and without any error...

That global option btw is model dependant. It does not exist on every FGT. 90/91/92D had it but 100E/D don't have and need it.

[ch4071c]

Hi sw2090,

Thanks.

Do you have any info on needed code to run to enable the right stuff? We also have FG100F and FG600E, but this issue is on a FG40. Do you mean to use a LAN port as WAN instead of the dedicated physical WAN port? Also, I'm running version 6.4, which is a very new release (too new?).

[sw2090]

Yes I mean to use a LAN port as WAN.

Unfortunately I don't remember the command anymore and the one FGT92D I used it on has recently died unfortunately. So I can't say anymore. Maybe I can browse trough old TAC tickets if I find the time to tomorrow.

[ch4071c]

Very nice. I would appreciate that very much.

[sw2090]

I did find that ticket again :)

It said:

conf sys global set hw-switch-ether-filter disable end

makes pppoe work on a lan port of a 92D (and maybe some other FGT)

The command as I said does not exist on a FGT100D and E for example.

[ede_pfau]

The FG-92D has had a hardware bug which is related to the handling of different ethertypes. This bug is only, and only, relevant for the 92D. To circumvent the bug, you can enable a switch in the config. It then enables processing PPPoE packets but discards others.

OTOH, doing PPPoE directly against a fiber with - assumingly - high bandwidth is not such a good idea anyway. PPPoE is not accelereated in hardware, the CPU has to handle it all. The small desktop FGTs max out at about 130 Mbps (as reported in the forums). Better use a modem in front.

[ch4071c]

Thanks.

Yeah, I found the article concerning the bug ( https://help.fortinet.com/fos-rn/6-0-4/Content/FOS_RN/0400_Special%20Notices/0800_FortiGate%20and%20... ).

I'm doing 250/250 mbit/s on my fiber connection, but I have a router delivered by my ISP which I cannot setup in bridge mode, so as I see it I have only one option left: Configure my FG40's WAN interface to PPPoE and terminate my fiber media converter directly in the FG40. I have PPP username and password from my ISP, but it seems impossible to debug the PPPoE interface/application as it says nothing about why it is failing.

Any more hints to seeing why PPPoE fails?