radius authentication failed

RouterOS General
1

Need a quick help.
I have a radius connected directly on MT. Almost all works fine but in last few days many of my users receiving authentication failed even they have correct user and password. Some of them after more attempts (as 10 or more) can get a connection but some of them have a continuous problem. Below is the part of log.
xx.xx.xx.xx is correct public IP that I provide to user, but next user get a IP 0.0.0.0 that is not correct. Also remote IP address is not correct

pppoe,ppp,info,account xxx.xxxxx logged in, xx.xx.xx.xx
pppoe,info PPPoE connection established from 00:0E:2E:D6:C4:C8
pppoe,ppp,info : waiting for call…
pppoe,ppp,info : authenticated
pppoe,ppp,info : could not determine remote address, using 10.112.177.5
pppoe,ppp,info : connected
pppoe,ppp,info,account yyy.yyyyy logged in, 0.0.0.0
pppoe,ppp,info,account yyy.yyyyy logged out, 0 130 66 6 5
pppoe,ppp,info <pppoe-yyy.yyyyy>: terminating…
pppoe,ppp,info <pppoe-yyy.yyyyy>: disconnected
pppoe,info PPPoE connection established from 00:80:48:25:00:77
pppoe,ppp,info : waiting for call…
pppoe,ppp,info : authenticated
pppoe,ppp,info : terminating… - disconnected
pppoe,ppp,info : disconnected
pppoe,info PPPoE connection established from 00:80:48:25:00:77
pppoe,ppp,info : waiting for call…
pppoe,ppp,info : authenticated
pppoe,ppp,info : terminating… - disconnected
pppoe,ppp,info : disconnected
pppoe,info PPPoE connection established from 00:80:48:25:00:77
pppoe,ppp,info : waiting for call…
pppoe,ppp,info : authenticated
pppoe,info PPPoE connection established from 40:61:86:5D:A9:33
pppoe,ppp,info : waiting for call…
pppoe,ppp,info : terminating… - disconnected
pppoe,ppp,info : disconnected
pppoe,ppp,info : terminating… - user qqq.qqqqq authentication failed
pppoe,ppp,info : disconnected
pppoe,info PPPoE connection established from 00:1C:F0:C5:40:C0
pppoe,ppp,info : waiting for call…
pppoe,ppp,info : terminating… - user http://www.wwwww authentication failed
pppoe,ppp,info : disconnected
pppoe,ppp,info : terminating… - user eee.eeeee authentication failed
pppoe,ppp,info : disconnected
pppoe,ppp,info : terminating… - user qqq.qqqqq authentication failed
pppoe,ppp,info : disconnected

I am 100% sure that all of users with authentication failed have a good user&pass.
I am also 100% sure that I have enough recourse with public IP addresses.

Thank you in advance,

2

Add radius debugging to the logs:

/system logging add topic=radius action=memory

What does the router say about its communication with the RADIUS server? Have you looked at the RADIUS server and its logs?

3

I enable logs now, I will store them on disk is to fast to check in memory.
Nothing strange with Radius and router, only few packets per sec as usually.
No, i have not look in radius log, actually I don’t know how, I have only phpmyadmin or webmin access right now.

4

You’re probably going to have to figure that out. The most likely issue is on the RADIUS server.

5

Here is a good connection:
sending Accounting-Request with id 17 to 10.10.10.1:1813
Signature = 0x8efa31283da765b4b8ed15b30e3451de
Service-Type = 2
Framed-Protocol = 1
NAS-Port = 64908
NAS-Port-Type = 15
User-Name = “aaa.aaaaa”
Calling-Station-Id = “00:22:15:17:51:CC”
Called-Station-Id = “PPPoE_Concetrator”
NAS-Port-Id = “LAN_ether2”
Acct-Session-Id = “81102082”
Framed-IP-Address = AA.AA.AA.AA
Acct-Authentic = 1
Event-Timestamp = 1317413632
Acct-Session-Time = 9662
Acct-Input-Octets = 86768248
Acct-Input-Gigawords = 0
Acct-Input-Packets = 159079
Acct-Output-Octets = 58528528
Acct-Output-Gigawords = 0
Acct-Output-Packets = 136231
Acct-Status-Type = 3
NAS-Identifier = “ASD”
NAS-IP-Address = 10.10.10.254
Acct-Delay-Time = 0

Here is a bad connection:
sending Access-Request with id 255 to 10.10.10.1:1812
Signature = 0x15a6b7a040b43249003267754134c7ae
Service-Type = 2
Framed-Protocol = 1
NAS-Port = 76743
NAS-Port-Type = 15
User-Name = “SSS.SSSSSS”
Calling-Station-Id = “1C:6F:65:6B:BD:9B”
Called-Station-Id = “PPPoE_Concetrator”
NAS-Port-Id = “LAN_ether2”
CHAP-Challenge = 0x78ac915303a7c3ca79f3b8adda62a295
CHAP-Password = 0x01d5650e6be2338c7024abb7cbd2c7fa
d0
NAS-Identifier = “ASD”
NAS-IP-Address = 10.10.10.254

6

Well, no. That’s an accounting request and an access request. When an access requests gets granted the router then sends an accounting request. They’re two different things.

More important is whether you see an ACCESS-ACCEPT or an ACCESS-REJECT coming back after an ACCESS-REQUEST that fails. If it comes back as a reject then the RADIUS server is dealing with the request just fine, but is saying ‘no’ for some reason. You’ll have to look at the RADIUS server to find out why. If you’re not getting any answer back there’s either a problem with the RADIUS server receiving the request (check logs on the RADIUS server, or do a traffic analysis on the RADIUS server to figure out which one is the case), or it isn’t handling it correctly. That also will require checking on the RADIUS server.

Either way you slice it the router is saying it’s generating access requests. So that part is fine. Now you need to troubleshoot the RADIUS server. Unless that’s User Manager this isn’t the right forum for that.