Possible bricked Satellites after downgrading from v4.6.7.5 to v 4.6.3.16

[tnine]

Hello,

  Since upgrading to the experimental firmware here, I've had a lot of issues with high latency and packet loss on my WAN (ping times jump to over 17 seconds for the next hop for 1-2 seconds every hour, which has always been < 1 ms with the same hardware).  As a result, I decided to downgrade from experimental firmware v4.6.7.5 to the last released firmware v4.6.3.16.  I have 3 satellites, so I performed my upgrade in the following order.

1) Downgrade my satellite "living room"

2) Downgrade my satellite "garage"

3) Downgrade my satellite "office"

4) Downgrade my RBR850 Router

After downgrading each satellite, it would not appear in the list of synced satellites.  I assumed this was due to a protocol version mismatch after the downgrade, so I proceeded to downgrade all 3 satellites.

After downgrading the router, I'm unable to connect any of my satellites.  The router is the only functioning unit, and it has a slow flashing white light.   All of the satellites have the same flashing slow light.

I've tried doing the factory reset outlined in this video.  However, once the LED starts flashing red, I release the paper clip and it immediately goes back to green light on the power input, with the slow flashing light on the front.   Given that I can't connect to any of my satellites, I can't put v4.6.7.5 back on, so I'm not sure how to proceed.  Any help would be greatly appreciated!

[FURRYe38]

What happens if you ethernet connect 1 of the RBS to the back of the RBR? Does it show on the RBRs web page? 

Can you connect to the RBRs web page after it was factory reset? 

[KMDonlon]

I was able to get my satellite up and running multiple times after playing around with the different firmware versions following these instructions:

https://kb.netgear.com/000059634/How-to-upload-firmware-to-a-NETGEAR-router-using-Windows-TFTP

[tnine]

Thanks for the help!  I have a somewhat naeive question... Which port is port 1? There aren't any numbers in the LAN ports.  Is it the port closest to the power plug, or the port closest to the sync button?  The manual here doesn't really have that information either. 

[plemans]

@FURRYe38 isn't meaning port 1. Just to connect it to one of the ports. 

Any of them should work with a wired backhaul. 

[FURRYe38]

Yes ANY of the LAN ports in back of the RBS.  

[tnine]

So, I've tried the following after getting on the phone with support.  It worked for 1 of my satellites.  The other 2 still won't function.

1. Unplug everything from the router except your WAN port
2. Plug an eternet connection from the RBS850 (Satellite) to the RBR850 (Router)
3. Using a paperclip, hold the reset button in the back of the RBS850 until the light in the back turns yellow and flashes. The white LED in the front will also flash.  The reset process takes about 1 minute and 10 seconds to happen via the paperclip.
4. Wait while the satellite reboots and syncs with the router.  In my 1 successful case, I waited 5 minutes as the device did the white pulsating light.  Eventually it shows up in my device list in the Web based UI under "Attached Devices" -> "Connected Satellites"

Unfortunately my other 2 just don't get past the flashing light. I do notice that the light sequence is subtly different.  For a couple of minutes during power on, it's a pulsating on and off, where the light is clearly dimming and getting brighter.  After about 2 minutes, it switches to a continuous on, then off in 1 second intervals. 

Any thoughts?  I've also tried the connections described above, pressed the sync on the Satellite, then the Sync on the Router.  This hasn't worked either. 

I've considered uploading the firmware via FTP as described here.  

https://kb.netgear.com/000059633/How-to-upload-firmware-to-a-NETGEAR-router-using-TFTP-client

However, 192.168.1.1 is the default IP for the router, NOT the satellites. I've tried 192.168.1.250 as described in other posts, but the device just doesn't appear to be listening on that IP address. 

Note that I'm also observing the power light alternates from green to red on the back of the units that are failing to boot successfully. 

[FURRYe38]

I presume your trying this with 1 RBS at a time while the others are disconnected from the RBR? 

IF the other RBS won't connect like the 1st one, possible they are in a bad state. I'd ask NG support about RMA options. 

[tnine]

@FURRYe38 You are correct.  I'm only plugging in 1 device at a time.  I can't seem to find what the power LED indicates since it's flashing from Green to Red. 

I've developed firmware before, mostly in aircraft tracking devices, so I'm amazed Orbi devices don't ship with a "golden" firmware that can always be booted and never overwritten.  We usually did that with the devices we shipped, and flashed firmware is written to a different section of the storage with a trampoline bootloader.  I guess netgear wanted to save a few bucks on the storage size! 

[FURRYe38]

Well I believe this maybe a change in deep in FW that maybe hard updating and going back maybe making things incompatible. 

Older versions of FW have had problems and v5 was to help bring in some stability since last year. Though it seems to have helps most users, maybe some hidden constraints that cause going back to older FW not possible and thus causing bad states in HW. 

There used to be a reset on the RBS and waiting 5 minutes with a wired PC connected to the RBS would get you in to the RBS web page at 192.168.1.250. I believe thats still supported on Orbi AC systems. However I believe NG either removed that on Orbi AX or someone forgot to put it back in. It was working back on older v3 FW however I believe something changed in later v3 versions or when they intro'd v4 last year i I also found that reset RBS and 192.168.1.250 was no longer working for me. 

I've forwarded this to NG for review. Also posted notice in the v5 FW threads as well. 

Only other thing you might try is re-udating the RBR back to v5 however not sure that will help with the RBS that seem to be in a bad state. 

If you can't get in using TFTP or nmrpflash:
https://github.com/jclehner/nmrpflash

I'd ask NG for a full RMA and send this set back. 

[NGSvensk]

I have the same thing happening with a downgrade!  I cannot do a factory reset on my satalite.   Is it same procedure with the TFTP program RBS?  Which port is port 1?  Because it looks like I cannot factory reset my RBS, the ip address is .42 instead of .1 but I tired both.  What firmware were you able to bring it back up with?

[KMDonlon]

I used v. 4.6.3.16... saved a copy for the RBS on my laptop, plugged it in via an Ethernet cable to my laptop only, not the RBR and was able to get satellite to come back (blue ring after pulsing white) following the instructions to the letter. Did it 5 or so times without issue.

[tnine]

Hi @KMDonlon !  What program and programming device did you use?  I'm trying to use nmrplfash, but it appears there's a bug when interacting with OSX 12.2.

https://github.com/jclehner/nmrpflash/issues/92

If that's what you used successfully, I'll boot into my Windows Boot camp and give it a shot from there.

[KMDonlon]

I used this, but I am running Windows 11 64 bit....

https://pjo2.github.io/tftpd64/

[FURRYe38]

Does nmrpflash work with the working RBS if you just connect the RBS up to the mac?

I don't know if this is a nmrpflash issue or the RBS are not in a good state thus the app is not able to connect properly. 

Try a OSX version prior if possible? 

---

@tnine wrote:

 I'm trying to use nmrplfash, but it appears there's a bug when interacting with OSX 12.2.

https://github.com/jclehner/nmrpflash/issues/92

If that's what you used successfully, I'll boot into my Windows Boot camp and give it a shot from there.

---

[tnine]

@KMDonlon Do you have a link to the instructions you followed?  Is this what you're referring to?  

https://kb.netgear.com/000059633/How-to-upload-firmware-to-a-NETGEAR-router-using-TFTP-client

@FURRYe38 I haven't tried to use it on my working RBS. Honestly I don't want to touch it.  If I lose the only working satellite, my wife won't be able to work because we don't have enough wireless coverage to reach her office from the main router. 

[FURRYe38]

I would be only to see if the app connects to a working RBS, you would not be sending down any files. 

---

@tnine wrote:

I haven't tried to use it on my working RBS. Honestly I don't want to touch it.  If I lose the only working satellite, my wife won't be able to work because we don't have enough wireless coverage to reach her office from the main router. 

---

[KMDonlon]

Yes, those are the instructions I followed.

[tnine]

So, the TFTP client linked to in the directions no longer works on the current version of Mac OS X, so I'll definitely have to use my Boot Camp Windows OS.

In terms of the instructions, I noticed it says "you should see the flashing orange LED" before I PUT.  I don't get a flashing orange LED, however, I do get a solid green one.  Eventually it flashes RED, then the boot cycle restarts.

If I use a paperclip and hold it in the Reset port for over 60 seconds, I do get a flashing orange led by the power.  If I continue to hold this down, it continues to flash.  Is this putting the Satellite in a mode I can upload firmware to it?

Lastly, the Satellite does not appear to have the IP of 192.168.1.1, that's the router.  What's the default IP of the satellites? 

Thanks,

Todd

[FURRYe38]

Used to be 192.168.1.250

[tnine]

Ok, so I was able to restore 1 of my satellites by the following process..

Configure my LAN port to the following:
IP: 192.168.1.20
Subnet: 255.255.255.0
Gateway: 192.168.1.1

I plugged a cable from my LAN port directly into port 1 of the Satellite.  They're labeled IN the port, so according to my label, port 1 was near the power cord.

I inserted a paperclip into the reset hole with the power cable unplugged

I then inserted the power cable.  The Power LED turned orange, then flashed orange.  I held this down for 1:30 (I timed it). I then removed the paperclip and let the unit boot

The LED light turns green, and I'm able to ping the Satellite at 192.168.1.250.   I opened up the Admin UI, but I didn't flash anything.  I just ensured I could connect to it

Power off the Unit, and Connect an ethernet cable from port 1 on the Satellite to Port 1 on the Router, an power on the satellite.  Wait for 5 minutes.

At the end of this 5 minutes, the satellite was registered in the Router as a wired connected Satellite.


I tried this same procedure with my second failing satellite, but with no luck.  After doing the reset, it seems to fail in the power on cycle before I'm able to connect to the admin interface.  Any ideas? 

[tnine]

So after compiling nmrpflash from the source, I'm able to get it to connect to the device following the first steps above.   To recap, I've done the following.

Manually configure my interface with the  192.168.1.20 IP

Plug the computere's LAN interface directly into the statellite

Ping the satellite: 

ping 192.168.1.250

Use the paperclip and power reset described above

As soon as the light turns green I get a response from ping, I then ran this command.

sudo nmrpflash -vvv -i en5 -f ~/Downloads/RBS850-V4.6.3.16/RBS850-V4.6.3.16-signed.chk

I then have this response.  I've omitted the packed + Ack transmissions until there's something worth noting.  Note the wrapping error mid transmit.

sudo nmrpflash -vvv -i en5 -f ~/Downloads/RBS850-V4.6.3.16/RBS850-V4.6.3.16-signed.chk
Adding 10.164.183.253 to interface en5.
Advertising NMRP server on en5 ... |
delete: cannot locate 10.164.183.252
Received configuration request from 6c:cd:d6:2d:72:6c.
Sending configuration: 10.164.183.252/24.
Received upload request: filename 'firmware'.
Using remote filename 'firmware'.
Uploading RBS850-V4.6.3.16-signed.chk ... << WRQ(firmware, octet)
<< WRQ(firmware, octet)
>> ACK(0)
<< DATA(1)
>> ACK(1)
<< DATA(2)
>> ACK(2)

...

<< DATA(65535)
>> ACK(65535)
Warning: TFTP block rollover. Upload might fail!
<< DATA(0)
>> ACK(0)
<< DATA(1)

...

<< DATA(2568)
>> ACK(2568)
OK (34868838 b)
Waiting for remote to respond.
Ignoring extra upload request.
Ignoring extra upload request.
Ignoring extra upload request.
Ignoring extra upload request.
Received configuration request from 6c:cd:d6:2d:72:6c.
Sending configuration: 10.164.183.252/24.
Received CONF_REQ while waiting for TFTP_UL_REQ!
Received configuration request from 6c:cd:d6:2d:72:6c.
Sending configuration: 10.164.183.252/24.
Received CONF_REQ while waiting for TFTP_UL_REQ!
Received configuration request from 6c:cd:d6:2d:72:6c.
Sending configuration: 10.164.183.252/24.
Received CLOSE_REQ while waiting for TFTP_UL_REQ!
Remote finished. Closing connection.
Reboot your device now.
10.164.183.252 (10.164.183.252) deleted

Yet, when connecting it to the Router as I've done for the other 2, it never joins the network.  The power LED light transitions from Green to solid at 1:08 from boot like clockwork. It stays red for 2 seconds, then reboots.   Is there some other way to clear the configuration?  Given it's a satellite, that option doesn't seem available in the UI. 

[FURRYe38]

Try pressing the reset button for 15 seconds then release. 

[tnine]

Thanks for that info @FURRYe38.. I tried 15 seconds starting when I plug it in, as well as 15 seconds after the unit has booted and the LED is green.  Neither seemed to work unfortunately 

[FURRYe38]

I recommennd you contact NG support and ask about RMA options.