6

This is a PHP (Zend Framework 1.11) site, not using an off-the-shelf package. When the request to:

https://live.sagepay.com/gateway/service/vspserver-register.vsp

(with a TxType of PAYMENT), I get the following response:

4020 : Information received from an Invalid IP address.

I have logged in to the SagePay admin area and added the IP address of the live server to the Valid IPs section and I've made sure it's using the correct SagePay URL to post to and.

An important note is that this issue started this morning, when we changed the SagePay account that payments get sent to, by changing the Vendor attribute.

Update: This same account (vendor) is used on other accounts with the Form integration method, but the site in question used the Server integration method. Can individual accounts support multiple different payment methods like this, or does one need to activate the other? I don't see any options relating to this in the admin panel.

LeonardChallis
  • 7,759
  • 6
  • 45
  • 76

4 Answers4

11

After getting a response from SagePay I have found the following important notes:

  • You can use Form/Server/Direct integration interchangeably on the same vendor's account, without needing to change settings or register anything
  • The 4020 error genuinely is an IP restriction error and is not masquerading another error

The issue here was that the IP address of the web server (www.mysite.com), being on a VPS, turned out to not be the same address as the one used when curl requests were made. I made a test PHP page that mailed the IP in $_SERVER['REMOTE_ADDR'] to myself and put it on another server. I then used curl to grab that script and low and behold it was a different IP. Putting (a zero padded version of) this in to the Valid IPs section in My SagePay control panel (logged in with the admin account) it sprung to life immediately.

Update

You can use:

curl icanhazip.com

Like so:

[user@host ~]# curl icanhazip.com
177.12.41.200

to display the correct IP to use, from the command line of the server you're hosting the web site on, instead of uploading files and all that malarkey. More information and usage here.

LeonardChallis
  • 7,759
  • 6
  • 45
  • 76
  • 1
    I had to call Sage Pay, and they tracked the failed transaction, gave me the correct IP to add to MySagePay, and i was good to go. – Collins Sep 21 '16 at 11:54
  • Excellent answer. Faced this problem several times. Only way to get actual server IP is using the CURL request you have explained above. – Patrick S Oct 01 '20 at 15:28
5

You have to add your IP address into SagePay control panel.

Other suggestions:

  • You can double-check your IP address at www.whatismyip.com and compare which what you added,
  • Make sure that your address didn't change since you added it (e.g. you have dynamic addressing),
  • Check if your Apache user is configured to use some different IP address,
kenorb
  • 155,785
  • 88
  • 678
  • 743
1

We need to add the web server IP address to Sagepay. (???Correct me if I'm wrong here)

For more details:

Local environment:

1) In your local environment, you need to find your public IP:

dig +short myip.opendns.com @resolver1.opendns.com
curl icanhazip.com
curl ipecho.net/plain

Or using: https://www.whatismyip.com/

In this case, the web server ip address uses your public ip.

2) Dev, staging, live environments: log in to the web server. Using the commands above to find the IP address.

Then, login to Sagepay account: Settings > Valid IPs > Add the IP address

enter image description here

Fill the IP address
(the Subnet mark mostly is 255.255.255.255)

Khoa TruongDinh
  • 913
  • 1
  • 13
  • 26
0

I contacted Sagepay about this error, having already tried adding my IP as described in the other answers (this didn't help).

In my case they said the problem was missing internal IPs on the account on their end, nothing to do with where the request came from.

They added the IPs while I was on the phone and that sorted the issue. If adding the server IP doesn't help it's well worth giving them a call.

totallyNotLizards
  • 8,489
  • 9
  • 51
  • 85
  • 1
    And to see the IP adding interface in the control panel you need to be logged in as an admin user – LeonardChallis May 16 '18 at 09:46
  • 1
    Same here. They said they cant help me unless I have merchant account ID etc. I don't have access to these but I do have admin access to MySagePay - Smart guy on the phone quickly identified that one particular SagePay internal IP address (which has nothing to do with my API call) was missing, he told me what it was, and my website works! **TL;DR phone them now** – vahanpwns May 24 '18 at 20:40