@Fae 

Fae wrote

Hello @1207 

 

Thank you for your valuable feedback on the ER605 1.2.3 Beta firmware.

 

Please allow me to confirm some details regarding the router disconnected issue you mentioned.

1. When the router was disconnected, would all of your network devices drop the network connection? Or would only the router get disconnected from the controller?

 -- Connections to the local network continued to work.  There was no web access for any client.  

 

2. What did you have to do to recover the connection when the issue happened? Would it work automatically after some time?

-- The router needed to be hard rebooted to restore web access.  It did not auto recover after 2 hours.

 

Regarding the Gateway ACL and mDNS service, could you please try to provide more details (setup and network diagram if possible) as possible as you can to help us better understand the issue you encountered?

 -- Added a Gateway lan-lan deny ACL to evaluate new functionality of the beta firmware.  The ACL blocked access from vlan1 (IoT) to vlan2. Tested the ACL and it blocked access as expected while allowing clients on vlan1 to respond to inquiries from vlan2 (stateful ACL).  Then I needed to allow some clients on vlan1 to access specific ports/clients on vlan2. So, added a switch permit ACL to allow the specific access, but the all clients on vlan 1 were still blocked.  Appeared the gateway ACL was a higher priority (overruling) the switch ACL.

 

Turned on mDNS service and selected Gateway, all networks, and enabled.  I turned off my Avahi server that I was using for mDNS.  The mDNS clients could no longer find other mDNS clients on the network.  I did not troubleshoot the issue for long as I turned my Avahi server backon.

 

Let me know if you have any other questions.  

 

Fae wrote

 

For your demand for allowing only some clients on vlan1 to access specific ports/clients on vlan2, it might be easy to achieve it in Standalone mode. We can create IP Groups for the specific clients on vlan1 and vlan2 separately (say group1 and group2), then create Gateway Block ACL with ALL direction to block access from !group1 to !group2. However, this is not supported in Controller for the time being, hope it be supported soon.

 

-- I already have the IP Groups created because I use them for my switch ACL's. They work on the switch, but they are not stateful.  Which requires me to take extra steps to manage a client on a blocked vlan.  It works, but is not very convenient.  Good to know IP_Groups are supported for Gateway ACL's in standalone mode. I will just wait until they are available under Controller mode.  

 

In addition, it's not true that the switch acl would be a higher priority than the gateway acls. Actually, the priority of ACL rules depends on where the packets would be sent to. For your case, the packets will be sent to the gateway eventually, so your configuration didn't make it.

 

--  I believe a switch deny ACL will prevent the Gateway ACL from taking effect, because it should block the packet at the switch and not allow it to reach the Gateway?  With a switch permit ACL I thought the switch was smart enough to send the packet to the correct port on the switch, if both clients were connected to the same switch. But this is not the case and requires the Gateway to route the packet.  

  @Fae 

For ER-605 v1 Beta, my understanding is, an Omada Software v5.8 is needed . Is there a beta for OC-200 v5.8? I have both OC-200 and OC-300 and both of them are 5.7.6 and I assumed that this new ER-605 v1 beta is for the stand-alone because my hardware controllers are below the v5.8 requirement so I never really tried them and I am too lazy to install a Software Controller to try it out (yay)....

As for Gateway ACL and Switch ACL, I have to turn off Gateway ACL since once the traffic leaves the L2 Switch, it will traverse the router, which will then trigger Gateway L3 ACL. I have it shown in Part 4 of this installment video.

  @Fae 

I was about to create a new post for the same issue, it looks like memory leak, memory usage starts around 35 when I reboot and slowly goes up to around 70 and then internet I'd dropped and the controller says Heartbeat Missed.

The cycle takes around a day.

I'm on software controller 5.9.9.

Hi @Fae,

Does the issue start to happen after you upgrade to the ER605(UN)_V1_1.2.3 Build 20230224 (Beta) Firmware?

If so, may I know the previous firmware version of your ER605 v1?

 This started to happen after the upgrade  my previous version was ER605(UN)_v1_1.2.2_Build 20230208 (Beta)

Would the router and only the router get disconnected from the controller finally?

 

Yes Only the router gets dicconected and i notice when my internet starts slowing down and then droped.

Would all of your network devices drop the network connection when issue happened?

 

While the DHCP lease does not expire devices connected to the network can still talk to eachother.

Would it work automatically after some time, or did you have to reboot the ER605 to recover the connection?

 

First time i waited at least 10 minutes but i had to reboot to recover.

How many client devices do you have in your network? Is there any VPN connection established in your network with torrent network activities such as cam video stream, or large file downloading?

We have 20 wireless clients and 8 wired.

two of the wired clients are connected to corporate VPN using constant video meetings.

We have 3 cameras contantly uploading data to the cloud.