[NEBULA] New Setup - 2x NWA1123-ACv2 - Always Offline

sborgMT
sborgMT Posts: 3  Freshman Member
First Comment Fourth Anniversary
edited April 2021 in Nebula
Hello everyone,

Excuse me for probably a stupid question. I had created a Nebula account some months ago, and put the final configuraiton on hold for various reasons. Today I could continue adding the two APs (2x NWA1123-ACv2) but no matter what, the two APs remain offline in NCC. My Nebula account is "free" after all this time, but I did not find any reference I could not get the two APs registered in NCC at least with basic functionality.

I verified MACs and Serial Numbers fo APs to be correct in NCC
NCC communication on the APs is on (and I can actually see an open connection on my firewall from the AP towards d.nebula.zyxel.com TCP port 6667)
Both APs remain offline, they do not register and the APs do not get the configuration from NCC

Am I doing something wrong?
Is this an issue of licensing?

I'm attaching some screenshots of NCC which could help in understanding.

I have been referring to the following link on what I can do with the "free" version. Either I'm misunderstanding or something is wrong with my configuration.
https://support.zyxel.eu/hc/en-us/articles/360000685119-My-Organization-has-been-downgraded-to-Nebula-what-are-the-changes-made-
https://www.zyxel.com/library/assets/solutions/nebula/pdf/nebula-licensing-table.pdf

I would appreciate any kind of insight,

Many thanks in advance!
Stefan

Accepted Solution

All Replies

  • Zyxel_Dean
    Zyxel_Dean Posts: 237  Zyxel Employee
    25 Answers First Comment Friend Collector Fourth Anniversary
    Hi @sborgMT ,

    First of all, the connectivity has nothing to do with any license related. Only thing requires it to go online is the network connection.
    If your firewall is not blocking the sessions for it to reach the server, you can try to switch the uplink to a different network to test if it is an ISP issue. To start with you can connect the AP to the uplink in front of your gateway to try if that is the cause.

    Dean
  • sborgMT
    sborgMT Posts: 3  Freshman Member
    First Comment Fourth Anniversary
    edited November 2018
    Thank you Dean for your message,

    The connection is unrestricted, and actually I can see it talking to the nebula site (destination 6667 and 443). I talked to Zyxel this morning on the phone, and they said that I should reset the APs to default config. I did that, and then they saw from the AP interface that the management mode was still "standalone" and that it should be "managed". They referred me to the CLI to change it manually using "hybrid-mode managed" but the CLI is only accepting "hybrid-mode cloud" or "hybrid-mode standalone". If I try "hybrid-mode managed" I get a parse error, and if I "hybrid-mode ?" I only get standalone and cloud as accepted options. I changed it to "cloud" and the interface of the AP changed, all the settings are gone and it's "waiting" for the configuration from NCC. The AP's interface is saying that it is connected to the Internet, but it's not connected to Nebula and that it's not registered with Nebula.

    I am 100% certain that the connection is unrestricted, and a PC on the same network as the AP can connect successfully to the same IPs and ports that the AP is opening towards nebula.

    What is worrying me is that the CLI PDF for these APs that Zyxel gave me over the phone (attached, section 9.3.1) is not consistent with the commands that the AP is accepting through SSH. The PDF they gave me is for the same firmware version as the version on the AP, and both are the latest firmware so something is very wrong on the APs. And I am now testing with 4x different APs, all the same NWA1123-ACv2. All with the same behavior and all with the same problem when using the CLI.

    I will try some more things and then I will have to call in again...

    Grrr... this is becoming a real head banger!

  • Zyxel_Dean
    Zyxel_Dean Posts: 237  Zyxel Employee
    25 Answers First Comment Friend Collector Fourth Anniversary
    Hi @sborgMT ,

    We normally don't use CLI to interfer with the state of the AP, potentially it might cause unsynced running configs for cloud devices.
    Personally I think the issue lies beyond your network and probably has something to do with the ISP. We sometime have customer's ISP blocking 6660-6668 ports.

    As we have noticed that our channel support asked us about your case, I've checked on the server side there was no records of established connection. So I think one thing to try now is take one device, connected it to network from a different ISP or 3G/LTE uplink.


  • BCS
    BCS Posts: 6  Freshman Member
    First Comment Friend Collector
    edited January 2020
    https://businessforum.zyxel.com/discussion/comment/5475#Comment_5475

    Hi,

    I'm writing to you because I had the same problem too, and I was able to solve it following the advice of @Nebula_Dean

    I opened a ticket to GFI (Aurea SMB Solutions), when I will be able to solve the problem definitively without eliminating the protocol inspector for the IRC protocol, I will post the solution here.

    Meanwhile you can find the official GFI help to disable the protocol inspector at this link:

    https://manuals.gfi.com/en/kerio/control/content/security/protocol-inspection-in-kerio-control-1689.html

  • 唐小鴨
    唐小鴨 Posts: 7  Freshman Member
    First Answer First Comment Friend Collector

    Actually, it's able to allow TCP port 4335 or 6667 to connect with Nebula as the firewall information shown, so there should be no problem if your port 6667 is blocked by ISP because the AP will use port 4335 to connect.

    Here's for your reference.

    image.png


  • BCS
    BCS Posts: 6  Freshman Member
    First Comment Friend Collector
    edited March 2020

    Edited on 23/03/2020

    Playing with the firewall I was able to make a rule without having to change the default configurations

    Configure a new rule without protocol inspector on traffic rules to allow switches to properly connect to the Nebula console:

    Configuration --> Traffic Rules --> Add

    traffic-rules-nebula-kerio-control.png


    Service configuration:

    Configuration --> Services --> Add

    service-nebula-kerio-control.png

    ---

    Edited on 31/01/2020

    the solution provided by GFI is not working properly, the only way to make zyxel nebula work with switches is to disable the protocol inspector for IRC as indicated above.

    ---

    Hi @sborgMT and @Nebula_Dean,

    here is the final solution to solve the problem from GFI Support.

    The problem on my part has been found only with the switches and not with the access points, probably the switches use port 6667 and the access points use port 4335.

    You must configure a service to allow traffic on port 6667 with the protocol inspector disabled,

    as in the following image.

    Configuration --> Services --> Add

    kerio-control-NETCONF.png


    For the IRC service you can leave the default configuration, as in the following image.

    image.png

Categories

Nebula Tips & Tricks


    Read more

    Nebula Help Center

    EnglishTiếng ViệtРусскийไทย中文（台灣）