Our pppoe-out internet connection has gone down twice now over the past two weeks.
Each time for nearly exactly 60 seconds. What red flags should be raised? What additional logging/actions should be taken?
Talked to the ISP and they said no known network outages during those times…
What exactly is in the log with regard to pppoe behaviour?
pppoe, ppp, info pppoe-out1:terminating… disconnected
pppoe, ppp, info pppoe-out1:disonnected
pppoe, ppp, info pppoe-out1:connecting
pppoe, ppp, info pppoe-out1:terminating…
etc; exact details in attached image
Weird indeed.
Is ROS version on your RB device current?
Is there a port isolation on access switch? Some bad user can spoof BRAS mac address.
Port based VLAN isolation setup. My concern is if this is an attack of some sort
ROS version stable 6.42.6
Are you sure it is PPPoE related and not that the carrier link has gone down? What technology are you connecting over?
Fiber (FTTP)
Not really sure if it is carrier or not. So asking what tools available can I use to unveil such mysteries..?
Use torch in tools.
Maybe, how can I log to file every time our connection drops out from the carrier/ISP??
We keep losing our L2TP tunnel as well and have to constantly rebuild the tunnel and reset the FW rules..
In “log” or use script made by yourself.
I am thinking more of a script that will send an email or SMS message to me when specific conditions are met.
Surely there is a way to send an HTTP request from router OS when a log event or fw event is triggered…?
One way to force script execution when a connection changes state is to use the on-up / on-down attributes of the /ppp profiles.
So you could have something like:
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1 max-mru=1500 max-mtu=1500 mrru=1614 name=pppoe-out1 password=****** \
profile=myprovider service-name=********* use-peer-dns=yes user=*********
/ppp profile
add change-tcp-mss=yes name=myprovider on-up=new-ip
/system script
add dont-require-permissions=no name=new-ip owner=admin policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
source="..."
I have dynamic WAN IP addresses in one MT router, so I’m using it to get the new address and modify some ipsec policies, firewall rules, etc. needing the WAN ip.
You could use it with /tool fetch to send a HTTP(S) request, etc.
Good answer!, thanks for that.