Hardware / firmware

• Gateway: Omada Fusion 2.5G (UN)
• Firmware: 1.0.10 Build 20260814 Rel.21177 (controller 6.3.14.2)
• Topology: Fusion WAN on a static IPv4 /30 business Ethernet handoff. LAN 192.168.1.0/24, gateway .254. SG3428XPP-M2 + ES206X-M2 + EAP720 / EAP725-Outdoor, all adopted. 

What works

• Clients browse the internet (Wi-Fi off, gateway .254).
• Public IP is the assigned static.
• Fusion Diagnostic nslookup via 8.8.8.8 succeeds for:
  • id.tplinkcloud.com
  • omada.tplinkcloud.com
  • n-device-omada-api.tplinkcloud.com
  • n-use1-device-api.tplinkcloud.com
• Local controller UI at the LAN IP is fine.

What fails

1. Cloud Access bind (Global → Settings → Cloud Access → Log In and Bind TP-Link ID).
   Error: Operation failed. Please check your network connection.
   TP-Link ID works in a browser at omada.tplinkcloud.com. Same password. Email is the ID. This is not the local controller admin account.
2. Check for firmware update throws the same error.
   I know 1.0.10 release notes say Firmware / Auto-Upgrade modules are temporarily unavailable and upgrades are manual from Device List. Calling that out so it is not mixed up with bind.
3. Time / NTP / auto DST
   Time page: NTP sync fails for time.google.com and others, and NTP IPs (216.239.35.4, 162.159.200.1). Timezone America/Detroit. Auto DST does not apply; 

Tried

• WAN DNS 8.8.8.8 / 8.8.4.4
• Echo Server custom to ISP gateway and 8.8.8.8
• IPS / DPI / web filter off
• IPv6 off on WAN
• Cloud Access toggle off/on
• Bind from web UI and from Omada app on the LAN
• Confirmed TP-Link ID login on a PC first

Not done

• Factory reset (production)
• WAN port-forward of controller ports

Ask

• Is Cloud bind + NTP known-broken on Fusion 2.5G 1.0.10, or should Diagnostic name resolution be enough for bind?
• How should auto DST / NTP be forced on this build if UDP 123 appears dead from the gateway itself?
• Any extra outbound requirement besides TCP 443 to *.tplinkcloud.com?