Remote Web Access No Longer Functional

[RobT]

For the first six months after installing the ISY-994i, remote web access and control worked perfectly. I had it configured on my iPad, smart phone, and remote computers. One morning, access was no longer possible on any client. Nothing has changed in any configuration (ISY, clients, router, ISP, bandwidth, traffic, addresses, etc.) and all other remote access devices are working via the same router and analogous configurations exactly the same as before. I have rebooted the ISY a couple of times and tried toggling the "Enable/Disable Internet Access" a few times. No joy.

 

Just today, I upgraded the ISY firmware to the latest version. No change in behavior. I also checked to ensure that the ISY retained the correct configurations. It had.

 

Suggestions?

 

Thanks.

 

[Teken]

Is the ISY using a static IP or DHCP? 

[RobT]

I think I left the ISY DHCP. I'll check but I have the router locked to serving it a fixed IP.

[Teken]

I think I left the ISY DHCP. I'll check but I have the router locked to serving it a fixed IP.

 

I gather you mean you reserved an IP address via MAC filtering. If this is the only appliance that is not reachable from outside of the WAN.

 

I would check any firewall / anti-virus and white list the controller . . .

[paulbates]

When you say remote, you mean access within your house's local network, correct?

 

When you launch the admin console from a computer, the finder should come up, and the IP address associated with the ISY should appear briefly, if not you can look under configuration.

 

Can you try using that IP address for web, etc?

[RobT]

Correct on the reservation. This is the only device no longer getting in. I have the ISY white-listed on the windows client firewalls but no such options on the AV and none have inquired for an exception. In addition, recall that all remote clients are failing, including iOS, Android, and Windows. When I get in front of the ISY, I'm going to toggle DHCP off, remove and replace the router reservation (maybe changing the IP at the same time), reboot all ans see how that goes. It is a bit unusual. I thought perhaps the issue had shown up for someone else. Any other suggestions?

 

Thanks!

[RobT]

PaulBates -- I mean WAN or LAN. I can access and control normally using the UDA Console locally.

[Teken]

Hello Rob,

 

Could you offer what the anti-virus program you're using? Also, it would be rather strange the program would not have a section to place it in the approved / white list.

 

Please go back and search anything that has to do with the ISY and add it in to the approved list. As a simple test disable the anti-virus and the firewall and see if you're able to gain WAN access.

 

Just to stick to the basics when you get home please do a check for your public IP. Verify the port forwarding value is also the same also did you happen to install a certificate?

[stusviews]

You need to do two tasks. First, ensure that you can ping the local address. Then ensure that the port is open: http://www.canyouseeme.org/

[RobT]

Teken,

 

The AV program is going to vary with the particular workstation and I have none on the iPad or smart phone.

 

I'm going to verify that the port forwarding and internal IPs still line up. I'll report back.

 

On the certificate, I would like to learn how to install one. Six months ago, I added the standard "trust this non-certificated URL" exceptions to Chrome and Firefox. Since I sync browsers fully across client machines, I only had to add the exceptions once per brand. Recall, though, that these non-certificated exceptions were working fine for six months. In addition, I am not getting the typical "certificate" warnings on any of the browsers. I get the "not found" and unable to connect" messages, depending on the browser. It is also possible that browsers change their rules without notice but the chance that Chrome and Firefox would do it on the same day is slim and, in addition, my other trust this URL exceptions are still working fine (I have cameras, remote storage, etc. on the same LAN and router).

 

 . . . just the ISY in the crowd.

Edited May 26, 2016 by RobT

[RobT]

Problem found!

 

Even though the router had reserved one fixed IP address based on the MAC address of the ISY but the local IP in the ISY configuration was different. The router's reservation was still in place but the ISY was now showing up with a different IP on the table of unreserved attached devices.

 

I confirmed that I had left the DHCP on in the ISY. I have now turned ISY's DHCP off.

 

I have not seen this before (it should not happen).  It is even more puzzling that the change took place one day after six straight months of unremarkable with no intervening changes or reboots, etc. If the addresses change again, we will know we have some kind of firmware glitch on one side or the other.

 

Thanks to everyone for their help.

[Teken]

Problem found!

 

Even though the router had reserved one fixed IP address based on the MAC address of the ISY but the local IP in the ISY configuration was different. The router's reservation was still in place but the ISY was now showing up with a different IP on the table of unreserved attached devices.

 

I confirmed that I had left the DHCP on in the ISY. I have now turned ISY's DHCP off.

 

I have not seen this before (it should not happen).  It is even more puzzling that the change took place one day after six straight months of unremarkable with no intervening changes or reboots, etc. If the addresses change again, we will know we have some kind of firmware glitch on one side or the other.

 

Thanks to everyone for their help.

 

Hello Rob,

 

Can you offer a little more insight and confirm the above? Essentially what I understand from above is the ISY Series Controller was and has always been set to DHCP mode, correct?

 

But some where down the road the reserved MAC address in the router say it was 100 changed to something like 101 in the ISY?

 

Can you please confirm that when you viewed the settings in the controller the screen was indeed grayed out and the value was different than what was listed in the router? Normally the router issues a lease time from the DHCP pool say every five days. But since the IP address was reserved via MAC filtering this should not have happen.

 

I would be curious to know what model and brand of router you have and if any firmware updates were done automatically or if one is pending for such an issue.

 

If you changed the ISY Series Controller to a Static IP address this does offer some measure of predictability because you always know what the IP address is to the appliance. It does not however protect you against a IP conflict. This is why its best practice to assign a IP address outside of the DHCP pool.

[MWareman]

 

 

Even though the router had reserved one fixed IP address based on the MAC address of the ISY but the local IP in the ISY configuration was different. The router's reservation was still in place but the ISY was now showing up with a different IP on the table of unreserved attached devices.

 

I confirmed that I had left the DHCP on in the ISY. I have now turned ISY's DHCP off.

 

I have not seen this before (it should not happen). It is even more puzzling that the change took place one day after six straight months of unremarkable with no intervening changes or reboots, etc. If the addresses change again, we will know we have some kind of firmware glitch on one side or the other.

 

Thanks to everyone for their help.

That can happen if the DHCP service is not available during the ISYs boot or address renewal (which will normally happen 2/3 of the way thru the address lease, configured on your DHCP server).

[RobT]

Teken,

 

Your recap is essentially correct. To clarify, the router was still reserving, say, 110 for the ISY but the router's attached devices table was showing that the router was serving the ISY at 111 and that there were no devices attached at 110. The configuration page on the ISY was showing 111. 

 

MWareman,

 

Your explanation makes sense. I had not thought of it. The only downside I see is that we have to assume that the ISY rebooted somewhere along the way. So far as I know, there is no way to confirm this. It would not be a power failure. The ISY and router are on a UPS the logs of which show only two brief failures during the period in question. Power would have been 100%, well regulated and filtered. Might the ISY have renewed it's DHCP lease somewhere along the way? If so, why did it renew at a different address?

Edited May 27, 2016 by RobT

[Teken]

Teken,

 

Your recap is essentially correct. To clarify, the router was still reserving, say, 110 for the ISY but the router attached devices table was showing that the router was serving the ISY at 111 and that there were no devices attached at 110. The configuration page on the ISY was showing 111. 

 

MWareman,

 

Your explanation makes sense. I had not thought of it. The only downside I see is that we have to assume that the ISY rebooted somewhere along the way. So far as I know, there is no way to confirm this. If would not be a power failure. The ISY and router on a UPS the logs of which show only two transitory failures during the period in question. Power would have been 100%, well regulated and filtered. Might the ISY have renewed it's DHCP lease somewhere along the way? If so, why did it change the IP?

 

Understood and appreciate the confirmation but this matter is quite strange and potentially dangerous if important systems need to be accessed.

 

If the router had the MAC address for the ISY reserved say 110 and you verified in the list that it was. The router needs to be inspected to see if there is a fault.

 

As the router is responsible for handling out the IP addresses along with many other attributes which you're more than aware of. The ISY can not summarily alter its IP address it can only take what is handed out to it.

 

If using a Static IP address is the road taken now please do ensure its well outside of the DHCP IP Pool. Best practices is to use blocks of IP addresses for appliances like A/V, Security, Media, Energy, Infrastructure, Network.

 

Next is to label and document the static IP addresses in a log book and append the very same to a rolling spread sheet kept in the cloud like Gmail, Hotmail, Yahoo, etc.

Edited May 27, 2016 by Teken

[TheFallenAngel]

But you had the DHCP in the ISY as a setting - not static IP, correct? If so - this is the issue.. The reservation in the router means this IP will not be given when a device requests a IP from the DHCP server of the router. That allows you to configure that reserved IP as a static IP in the ISY and not worry that that same IP could be served to another device.

 

If ISY was still set to DHCP mode - it requests IP address (fire whatever reason) and the the Router's DCP Server will give it the next available IP from the pool (excluding any reserved ones).

 

This is normal behaviour. So reservation in the DHCP sever is used when you want to use Static IP in the device.

 

This being said - the are some router firmwares that will check the MAC upon request and serve it if matched (the intelligent approach) but this is implementation dependant and not standard behaviour..

 

Cheers,

Alex

[MWareman]

Might the ISY have renewed it's DHCP lease somewhere along the way?

Likely, yes. Even with static assignments, there is a lease time after which the lease must be renewed, requiring the original DHCP service that initially granted the lease to be available to renew it.

 

If so, why did it renew at a different address?

Sometime during the lifetime of a DHCP lease, clients send a packet to to the original DHCP service that gave the now expiring lease to ask 'is it OK I keep using this address?'. If it gets no answer, it tries again (3 times I believe). If still no answer, or the original DHCP service is no longer available, the client does a full DHCP acquire again. With no static assignment, there is no assurance of getting the same address at all.

 

Could you have two DHCP services on your LAN? Might you have reserved the address in only one of them? I'd confirm you only have one by looking at all your dhcp clients and checking to see the address of the DHCP server they got their address from, to be sure.

Edited May 28, 2016 by MWareman

[RobT]

Could you have two DHCP services on your LAN? Might you have reserved the address in only one of them? I'd confirm you only have one by looking at all your dhcp clients and checking to see the address of the DHCP server they got their address from, to be sure.

This is a great question. I can think of a few devices, a repeater especially, that might possibly be serving an address. It should be in a different range but worth a check.