EC:10001 – Routing / ASN validation issue affecting one of my two ASNs
Hello EA Support / Network Team,
I am a Senior Network Engineer managing two separate Autonomous Systems (below are example ASNs):
- AS1 (my primary ASN): Directly peered at multiple Internet Exchanges with good, short paths to major providers.
- AS2 (newer ASN, ~1 year old): Operates as a downstream customer of AS1 (AS2 prefixes are announced via AS1 as upstream/transit).
I fully manage routing, IRR objects, RPKI, and BGP advertisements for both ASNs. The prefixes from both ASNs are announced identically toward my upstream transit provider and public IX peers. The only real difference is the originating ASN.
Issue:
- From any IP prefix originating from AS2, the EA Desktop app fails to log in with error EC:10001.
- Switching the source IP to any prefix from AS1 (same physical location/hardware/etc.) allows login immediately with no issues.
From the EA Desktop logs on AS2 (fresh capture after clearing logs):
ERROR (eax::services::identity::AccessTokenRequestor::parseResponse) Invalid token, could not find geocountry
This leads to:
- AccessTokenError_InvalidToken
- AccessTokenFailed
- Final error EC:10001
I have already verified:
- No blacklisting of my AS2 prefixes.
- Public geolocation databases and my own geofeed correctly show the country as South Africa.
- Full reachability (ping, traceroute) to EA/Akamai/AWS endpoints works fine from both ASNs.
It appears EA’s authentication backend is treating traffic from AS2 (transit/customer ASN) differently than from my AS1 (direct-peered ASN) during the token issuance / geo-validation step.
Interestingly, I also cannot log into the EA forums from AS2 IPs, but it works instantly when switching to AS1.
Live chat support directed me here. Could someone from the EA network / auth team please investigate and escalate this? Happy to provide traceroutes from both ASNs, full logs, or any other diagnostics if needed, feel free to PM me so I can share.
Thank you in advance.
