Fortiwifi 60E and SKY Fibre Broadband

[Jasys]

Hi, Hoping someone can offer some help.

The Company I work for has partnered with Fortinet and provided certain engineers with Fortiwifi 60E units, I need to put this on my Network at home (they supplied these for us to use and play with)

I am with SKY FTTC, and as you may be aware, they are a nightmare as they lock down thier SKY Modem/Routers, they use MER (Mac Encapsulated Routing) which can be extracted using wireshark, which I have done to get the username and password.

So on my Fortigate, I use "WAN1" with PPOE, using the extracted username and password.

I removed the SKY Router, and plugged in a BT Openreach VDSL Modem, then connected that to WAN1

DSL light goes solid on the Modem, So I know that parts working, The WAN1 on the Gate, will not get an IP Address... just says Failed.

I even tried using subst-mac-dst on the WAN1 interface on the CLI, to "spoof" the SKY routers MAC, still nothing, has anyone any ideas please?

Thanks

[ede_pfau]

Shouldn't be the spoofed MAC on the modem's WAN port? It's not relevant inside.

[Jasys]

ede_pfau wrote:

Shouldn't be the spoofed MAC on the modem's WAN port? It's not relevant inside.

 Its not on the inside (My inside is using 10.10.20.1) , its facing the Modem, so essentially the WAN facing SKYs network.

This morning I even tried, to put the SKY Router back, changed it too modem only mode, and pushed all traffic to a DMZ address of 192.168.0.2, and configured my Fortigate WAN1 to this address. Still nothing.

Really fustrated (I am 100% sure this is not an issue with the Fortigate) I really need to get this working.

[ede_pfau]

nope, you got me wrong. 'internal' in that sense is everywhere else in contrast to 'public' which the ISP sees. So, if the ISP authenticates via MAC then the "ISP facing" interface has to have the authorized MAC. And not some interface behind that, including the FGT.

In contrast to IP addresses MAC addresses cannot be "forwarded" or such.

[Jasys]

That's exactly what I said , it will authenticate on the public facing MAC. Private LAN does not need authentication in this scenario,  Anyway,  Has anyone had experience with Firewalls and SKY? Some Cisco ASAs can't supply option 61 so these don't work, but there must be a workaround..

[ede_pfau]

I even tried using subst-mac-dst on the WAN1 interface on the CLI, to "spoof" the SKY routers MAC,

and then you cite a FortiOS CLI command for this. But, you need to spoof the BT modem's WAN port MAC - the FGT doesn't have anything to do with this.

Have you tried this?

[Jasys]

That won't work. The modem want port does need spoofing, it's pppoe, so you have to configure the want port on the Fortigate with authenticatuon details, anyway, 

Because of MER, it is not possible to work with sky, I have switched providers,  then this will work :) thanks for the chat about it though.

[David_Williams]

Hello, man. I had the problems with the providers too. Frankly speaking, it isn't the secret, that a lot of providers are so bad nowadays. I mean, that if you want to have good internet speed, you should pay a huge amount of the money. When I remained the nightmare, which I had, when we were finding the good provider for our villa, I want to scream and cry. 5 providers, CARL. We changed 5 providers. Moreover, we had to pay even, when we weren't at the villa, but likely for us, my son found the article, this is link for it - https://usave.co.uk/, which refers to such great function "Get Broadband Without Signing Up for a Monthly Contract". Now not only the internet speed is higher, but we also haven't to pay for it, when we don't live at the villa.