xvzf / zyxel-gpon-sfp

Telekom FTTH with OpenWRT/PfSense/VyOS/Mikrotik/... (Reverse engineering Zyxel PMG3000-D20B GPON SFP)
191 stars 26 forks source link

No more access to module after setting speed to 2.5G #19

Closed umatz closed 1 year ago

umatz commented 1 year ago

Maybe someone might have a hint for me...

After finally getting my ftth line activated by the ISP I was able to access the module on 10.10.1.1 (it sits in a MikroTik RB2011 router), no access before without an active fiber. After a little digging around I decided to set the interface speed do 2.5G with ZYXEL# hal Hal# set speed 2.5g mode full because I hat noticed that the fiber speed was announced with 2.5G capacity. After executing the command I can longer access the module on 10.10.1.1. Apparently the above command sets the speed on the internal/LAN side and not on the fiber/WAN side and I have now locked out access to the module because the routers SFP-Slot does not support 2.5 ethernet?

I already tried to disable auto negotiation and set fixed speeds of 1G and 2.5G but I cannot ping the module anymore. I am not sure if PPPoE-Client would work now on this interface in this state and if I have bricked the module.

Any idea?

jaseg commented 1 year ago

IIRC the module uses an SPI flash IC for the root file system. One way to recover would be to do what the coreboot people do, and hook up that IC to a raspberry pi using some temporarily soldered wires. Then you would be able to read out, modify, and re-flash the IC.

poshul commented 1 year ago

There's also a serial connection on the board: https://github.com/hack-gpon/hack-gpon.github.io/blob/main/_ont/ont-zyxel-pmg3000-d20b.md. You can hook up with a buspirate or equivalent.

umatz commented 1 year ago

Thanks for the answers. I will try to get access via serial console, alas, information of how to do so is a little sparse.

umatz commented 1 year ago

I was not able to obtain information on how to connect a serial console on this module. The two marked pads are Rx/Tx but I do not know where to get Ground and Vcc (3,3V) IMG_2037 Meanwhile I bought a second module, configured the serial number and am now online with IP DNS:NET. I will close this ticket as it is no "bug".

jaseg commented 1 year ago

All of the metal is ground, and VCC is probably most easily accessible on the 8-pin SPI flash, the big chip labelled "GigaDevice" in your picture. Here's a datasheet of the chip link, VCC is on pin 8, the top right pin in your picture.

umatz commented 1 year ago

I just wanted to let the interested know that I was successful. I forgot to take a photo but after removing the pcb completely from the sfp case I got access to the other side of the sfp 'header'. The two middle pins are VCC 3.3V and the two outer pins on each edge are GND. After soldering an USB-serial adapter to the four pins I got access to a full serial console, could watch the boot process and logon to the system (exactly like vie ssh). I could set the speed back to the default values with Hal# set speed default mode default Thanks again for the support here.

kayrus commented 7 months ago

Meanwhile I bought a second module, configured the serial number and am now online with IP DNS:NET

@umatz, I'd like to connect to DNS:NET with this module as well. Can you clarify is it necessary to change the serial number to get connected to DNS:NET? Where can I find this serial number? I have a fibertwist with 3 numbers on the label:

Which one do I need to set? And where can I get the PLOAM password?

umatz commented 7 months ago

Hi @kayrus ,

I have a passive fibertwist and got a FritzBox 5530 from DNS:NET (fiber optic cable between fibertwist and fritz box). I extracted the gpon_serial from the FritzBox (via a diagnosis dump) and set the "PON SN" of the Zyxel sfp module to the same value. Thus I could connect to DNS:NET without any changes necessary on their side. I think I didn't change the PLOAM password, in my Zyxel module it is set to 'default'.

kayrus commented 7 months ago

thanks, @umatz. I'll try it once I get an SFP module.

I do not know where to get Ground and Vcc (3,3V)

ground is usually linked with the shell. Vcc usually can be ignored, since 3.3V USB UART controllers get power from the USB. Do you still own a broken module?

umatz commented 7 months ago

Do you still own a broken module?

No, see my comment directly above your first question, I was able to reset the speed after successfully connecting an USB-adapter, so i have now two working adapters.

kayrus commented 7 months ago

No, see my comment directly above your first question

oh, somehow I missed this. Too much information about the GPON and SFP was read meanwhile

motorsense commented 5 months ago

Hello, i have also set it to 2,5G. Then no connection problem. (X520 Card) I have solve it with a cheap China switch with SFP+ ports. (ZX-SWTG124AS) -Set the port speed of SFP+ at the switch manualy to 2,5G -configure Port mirror SFP+ port to PC port on switch -then i configure my pc address to 10.10.1.2/24 -i can connect via SSH to the module

I hope it can help others