Why PPPoE Authentication Fails: An Overview

PPPoE (Point-to-Point Protocol over Ethernet) is the backbone of broadband connectivity for millions of subscribers across India. When authentication fails, subscribers get disconnected, support tickets pile up, and ISP revenue takes a hit. Understanding the root cause quickly is critical.

Authentication in a PPPoE setup involves multiple layers — the CPE (Customer Premises Equipment), the BRAS/NAS (Broadband Remote Access Server / Network Access Server), and the RADIUS server. A failure at any one of these layers can result in the dreaded 'Authentication Failed' error.

In this guide, we walk through the most common causes of PPPoE authentication failure and how to fix them — especially in environments running a RADIUS-based AAA server like OneRADIUS.

---

Understanding the PPPoE Authentication Flow

Before troubleshooting, it helps to understand how PPPoE authentication works:

  1. The CPE (router/modem) sends a **PADI** (PPPoE Active Discovery Initiation) broadcast.
  2. The BRAS responds with a **PADO** (PPPoE Active Discovery Offer).
  3. The CPE sends a **PADR** (PPPoE Active Discovery Request).
  4. The BRAS sends a **PADS** (PPPoE Active Discovery Session-confirmation).
  5. A PPP session is established and **LCP negotiation** begins.
  6. Authentication starts — typically using **PAP** or **CHAP**.
  7. The BRAS forwards credentials to the **RADIUS server** using an Access-Request packet.
  8. The RADIUS server responds with **Access-Accept** or **Access-Reject**.

If any step from 6 onwards fails, the subscriber sees 'Authentication Failed.'

---

Common Causes of PPPoE Authentication Failure

1. Incorrect Username or Password

This is the most frequent cause. Subscribers may mistype their credentials, or their password may have been changed without their knowledge.

How to fix:

  • Verify the username and password stored in the RADIUS user database.
  • In **OneRADIUS**, navigate to the subscriber management panel and check the account credentials.
  • Reset the password if necessary and ask the subscriber to re-enter it on the CPE.
  • Ensure there are no leading or trailing spaces in the username field.
💡 Tip: In OneRADIUS, you can quickly search for a subscriber by username and view their current authentication status and recent login history.

2. Account Expired or Suspended

A subscriber's account may have expired due to non-payment or may have been manually suspended by the ISP.

How to fix:

  • Log in to **OneRADIUS** and check the subscriber's account status.
  • If expired, renew the plan or extend the validity.
  • If suspended, check the reason and re-enable the account if appropriate.
  • After making changes, the RADIUS server will accept the next authentication attempt automatically — no restart needed.
⚠️ Warning: Never manually edit the RADIUS database directly without using the management interface. Incorrect edits can corrupt subscriber records.

3. RADIUS Server Unreachable from BRAS/NAS

If the BRAS cannot reach the RADIUS server, all authentication requests will time out and fail.

How to fix:

  • Ping the RADIUS server IP from the BRAS/NAS to verify network connectivity.
  • Check firewall rules — ensure UDP ports **1812** (authentication) and **1813** (accounting) are open.
  • Verify that the RADIUS server is running: check the OneRADIUS service status on the host server.
  • Review NAS configuration to ensure the correct RADIUS server IP and shared secret are configured.
💡 Tip: OneRADIUS provides real-time service monitoring. Check the dashboard for server health and active connection status.

4. Shared Secret Mismatch

The shared secret between the BRAS/NAS and the RADIUS server must match exactly. Even a single character difference will cause all authentication to fail silently.

How to fix:

  • On the BRAS/NAS, locate the RADIUS client configuration and note the shared secret.
  • In **OneRADIUS**, go to NAS/Client management and verify the shared secret for that NAS IP.
  • Update the shared secret on either side to match — make sure both are identical, including case sensitivity.
  • Avoid special characters that may be interpreted differently by different systems.
⚠️ Warning: Shared secret mismatches often produce generic 'Access-Reject' errors in logs with no clear indication of the root cause. Always check this first when setting up a new NAS.

5. NAS IP Not Registered in RADIUS

If the BRAS/NAS IP address is not registered in the RADIUS server's client list, the RADIUS server will silently drop all requests from that IP.

How to fix:

  • In **OneRADIUS**, navigate to the NAS/Client section.
  • Add the BRAS/NAS IP address with the correct shared secret and NAS type.
  • Save the configuration — no server restart is required in OneRADIUS.
  • Test authentication from the subscriber end.

6. Wrong Authentication Protocol (PAP vs CHAP)

A mismatch between the authentication protocol expected by the RADIUS server and what the CPE is sending will cause authentication to fail.

How to fix:

  • Check what protocol your BRAS is configured to use (PAP or CHAP).
  • Verify that the CPE is configured to use the same protocol.
  • In OneRADIUS, check if there are protocol-specific restrictions configured for the subscriber or profile.
  • For most Indian ISP deployments, **CHAP** is preferred as it does not send plaintext passwords.
💡 Tip: CHAP requires that passwords be stored in a recoverable format in the RADIUS database. If passwords are stored as hashed values only, CHAP will fail. OneRADIUS supports both PAP and CHAP — verify your storage settings.

7. Data Limit or FUP Policy Exceeded

Some ISPs configure RADIUS to reject authentication when a subscriber's data quota is exhausted. This can appear as an authentication failure.

How to fix:

  • Check the subscriber's data usage in **OneRADIUS**.
  • If the FUP (Fair Usage Policy) limit has been reached, either top up the plan or reset the data counter.
  • Consider configuring a redirect-to-portal approach instead of outright rejection, for a better subscriber experience.

8. Simultaneous Session Limit Exceeded

If a subscriber already has an active session and tries to log in again from a different device, the RADIUS server may reject the second login attempt.

How to fix:

  • In **OneRADIUS**, check the active sessions for the subscriber.
  • Disconnect stale or zombie sessions manually from the session management panel.
  • Adjust the simultaneous-use limit in the subscriber's profile if needed.
  • Enable session cleanup to automatically clear dead sessions after a configurable timeout.
⚠️ Warning: Zombie sessions (sessions that appear active but have no real traffic) are a common issue with PPPoE and can silently block legitimate logins. Set up periodic accounting checks to detect and clear them.

9. RADIUS Timeout or Latency Issues

If the RADIUS server takes too long to respond, the BRAS may time out the authentication request and report it as failed.

How to fix:

  • Check server load on the OneRADIUS host — high CPU or memory usage can slow response times.
  • Verify database query performance — slow queries can cause response delays.
  • Increase the RADIUS timeout value on the BRAS (typically from 3 seconds to 5-10 seconds for high-load environments).
  • Consider deploying OneRADIUS on dedicated hardware or a high-performance VM for large subscriber bases.

10. Certificate or EAP Issues (for EAP-based Authentication)

For ISPs using EAP (Extensible Authentication Protocol), expired or misconfigured certificates can cause authentication failures.

How to fix:

  • Verify that EAP certificates on the RADIUS server are valid and not expired.
  • Ensure the correct CA certificate is installed on CPE devices.
  • Review EAP method compatibility between CPE, BRAS, and RADIUS server.

---

How to Read RADIUS Logs to Diagnose PPPoE Authentication Failures

Logs are your best friend when troubleshooting. Here is what to look for:

In OneRADIUS Logs:

  • **Access-Request received** — confirms the BRAS sent the request to the RADIUS server.
  • **Access-Reject sent** — RADIUS rejected the request. Check the reject reason in the log detail.
  • **No response logged** — the request never reached the RADIUS server. Check network/firewall.
  • **User not found** — username does not exist in the database.
  • **Wrong password** — credentials mismatch.
  • **Account disabled/expired** — account status issue.
💡 Tip: OneRADIUS has a built-in live log viewer and authentication log report that lets you filter by username, NAS IP, date range, and result code — making it easy to pinpoint failures without digging through raw log files.

On the BRAS/NAS:

  • Check PPP debug logs for LCP and authentication phase messages.
  • Look for 'Access-Reject' or 'Timeout' messages in RADIUS communication logs.
  • Capture packets on the RADIUS port to verify traffic is actually reaching the server.

---

Step-by-Step Troubleshooting Checklist

Use this checklist when a subscriber reports PPPoE authentication failure:

  • **Step 1:** Confirm the correct username and password are being used.
  • **Step 2:** Check the subscriber account status in OneRADIUS (active, expired, suspended).
  • **Step 3:** Check for simultaneous session limits — clear stale sessions if needed.
  • **Step 4:** Verify data quota and FUP status.
  • **Step 5:** Confirm the NAS/BRAS IP is registered in OneRADIUS with the correct shared secret.
  • **Step 6:** Ping the RADIUS server from the BRAS to verify connectivity.
  • **Step 7:** Check UDP ports 1812 and 1813 are open on the firewall.
  • **Step 8:** Review OneRADIUS authentication logs for the specific error message.
  • **Step 9:** Check BRAS PPP logs for protocol-level errors.
  • **Step 10:** If all else fails, capture RADIUS packets with Wireshark for deep analysis.

---

Preventing PPPoE Authentication Failures Proactively

The best troubleshooting is prevention. Here are best practices for ISPs:

  • **Monitor RADIUS server health** continuously using OneRADIUS dashboard alerts.
  • **Set up automated session cleanup** to avoid zombie session buildup.
  • **Use strong but simple shared secrets** — avoid ambiguous characters like 0 (zero) vs O (letter).
  • **Keep RADIUS server software updated** — OneRADIUS releases regular updates with bug fixes and performance improvements.
  • **Configure RADIUS redundancy** — set up a secondary RADIUS server for failover to avoid single points of failure.
  • **Train support staff** to use the OneRADIUS log viewer and subscriber management tools for faster resolution.
  • **Send proactive notifications** to subscribers before plan expiry to reduce authentication failure tickets.

---

Why OneRADIUS Makes PPPoE Troubleshooting Easier

OneRADIUS by ARCR Technologies is built specifically for Indian ISPs and understands the challenges of managing large PPPoE subscriber bases. Key features that help with troubleshooting include:

  • **Real-time authentication logs** with detailed reject reason codes.
  • **Live session management** to view and disconnect active or stale sessions.
  • **Subscriber dashboard** with complete account, plan, and usage history.
  • **NAS/Client management** with easy shared secret configuration.
  • **Automated alerts** for server health and authentication anomalies.
  • **Multi-NAS support** for ISPs with multiple BRAS devices across geographies.

With OneRADIUS, what used to take hours of manual log digging can now be resolved in minutes — keeping your subscribers connected and your support team efficient.

---

Conclusion

PPPoE authentication failures can stem from many causes — wrong credentials, expired accounts, network issues, configuration mismatches, or server performance problems. A systematic troubleshooting approach, combined with powerful tools like OneRADIUS, helps ISPs resolve these issues quickly and minimize subscriber downtime.

If you are an ISP in India looking for a reliable, feature-rich RADIUS AAA solution, explore OneRADIUS at oneradius.com and see how it can transform your network management and support operations.

💡 Tip: Have a persistent PPPoE authentication issue that is not covered here? Contact the OneRADIUS support team — we provide dedicated technical assistance for ISPs running OneRADIUS.