This knowledge base article describes an observed PPPoE authentication failure where the Link Control Protocol (LCP) phase successfully completes, but the subsequent authentication (CHAP) fails, leading to session termination.

From the monitor traffic interface output, the following sequence is observed:

"LCP, Term-Ack (0x06), id 4, length 6" followed by "CHAP, Fail (0x04), id 55, Msg Authentication Failure"

13:41:00.111860 In PPPoE [ses 26896]LCP, Conf-Request (0x01), id 2, length 21

13:41:00.112079 Out PPPoE [ses 26896]LCP, Conf-Nack (0x03), id 2, length 10

13:41:00.120391 In PPPoE [ses 26896]LCP, Conf-Request (0x01), id 3, length 21

13:41:00.120549 Out PPPoE [ses 26896]LCP, Conf-Ack (0x02), id 3, length 21

13:41:00.163723 In PPPoE [ses 26896]CHAP, Challenge (0x01), id 55, Value xxxx, Name xxxx

13:41:00.163915 Out PPPoE [ses 26896]CHAP, Response (0x02), id 55, Value yyyy, Name xxx@yyy[|chap]

13:41:01.186315 In PPPoE [ses 26896]LCP, Term-Request (0x05), id 4, length 6

13:41:01.186459 Out PPPoE [ses 26896]LCP, Term-Ack (0x06), id 4, length 6

13:41:01.287175 In PPPoE [ses 26896]CHAP, Fail (0x04), id 55, Msg Authentication Failure <<

13:41:01.300725 In PPPoE PADT [ses 26896]

13:41:02.722330 Out PPPoE PADI [Host-Uniq UTF8] [Service-Name]

13:41:02.838512 In PPPoE PADO [Host-Uniq UTF8] [Service-Name] [AC-Name "xxxx"]

13:41:02.838669 Out PPPoE PADR [Host-Uniq UTF8] [Service-Name] [AC-Name "xxxx"]

13:41:03.183973 In PPPoE PADS [ses 26897] [Host-Uniq UTF8]

This indicates that the PPP LCP session was successfully established, but authentication failed during the CHAP phase, causing the PPPoE session to terminate.

The failure typically occurs during the authentication phase after successful LCP negotiation. Review and validate the following items:

1.Incorrect username or password

Ensure the PPPoE credentials configured on the device exactly match those provided by the ISP. Even minor mismatches will result in CHAP authentication failure.

2. Authentication protocol mismatch

The client may be configured to use CHAP while the ISP expects PAP, or vice versa. Confirm the required authentication protocol with the ISP and adjust the configuration accordingly.

3. CHAP hostname and secret verification

Verify that the configured CHAP hostname and secret are correct and aligned with the ISP’s expected values.

4. ISP-side validation

If all local configurations are verified, engage the ISP to confirm that the credentials and authentication method are correctly provisioned on their side.