Troubleshooting Tip: PPPoE connection failure due to 'Remote message: Login incorrect'

Description

This article describes the troubleshooting process for PPPoE connection failures where the remote server responds with a 'Login incorrect' message, resulting in a PAP authentication failure during the connection establishment phase, after which the server sends a connection terminated message.

Scope

FortiGate.

Solution

PPPoE connection fails because the remote server responds with a 'Login incorrect' message, which causes the PAP authentication process to fail during connection establishment, after which the server sends a Connection Terminated message.

PPPoE debug:

diagnose debug reset
diagnose debug disable
diagnose debug app pppoed -1
diagnose debug app ppp -1
diagnose debug enable

While initiating a PPPoE connection, the PPPoE debug output displays the following error:

connect_session()-498: Discovery Phase Successful!!
pppoe_connect_session()-311: dev: wan1 pppoe discovery stage is complete
pppoe_establish_ppp()-363: fd: 12
using channel 1060
Using interface ppp2
Connect: ppp2 <--> wan1
Parent: pppoed
pppoe_send_config()-652:
pppoe_recv_config()-675:
PPP send: LCP Configure_Request id(1) len(14) [Maximum_Received_Unit 1492] [Magic_Number E76BE3F3]
PPP recv: LCP Configure_Request id(1) len(18) [Authentication_Protocol PAP] [Maximum_Received_Unit 1492] [Magic_Number F0B0B36C]
PPP send: LCP Configure_Ack id(1) len(18) [Authentication_Protocol PAP] [Maximum_Received_Unit 1492] [Magic_Number F0B0B36C]
PPP recv: LCP Configure_Ack id(1) len(14) [Maximum_Received_Unit 1492] [Magic_Number E76BE3F3]
pppoe_send_config()-652:
pppoe_recv_config()-675:
PPP send: LCP Echo_Request id(0) len(8) [Magic_Number e76be3f3]
PPP send: PAP Authentication_Request id(1) peerid(len=17, <username>)
PPP recv: LCP Echo_Reply id(0) len(8) [Magic_Number f0b0b36c]
PPP recv: PAP Authentication_Nak id(0) packet_len=20, message_len=15
Remote message: Login incorrect
PAP authentication failed
pppoe_send_config()-652:
pppoe_recv_config()-675:
PPP send: LCP Termiate_Request id(2) len(44)
PPP recv: LCP Termiate_Request id(2) len(48)
PPP send: LCP Terminate_Ack id(2) len(4)
PPP recv: LCP Terminate_Ack id(2) len(4)
Connection terminated.

For collecting PPPoE debug logs, refer to Troubleshooting Tip: Troubleshooting PPPoE connection failed.

To capture packets at the session stage, use the sniffer below:

diagnose sniffer packet <interface name> "ether proto 0x8864" 6 0 a 

Packet capture is shown below for reference:

The above session-stage PCAP shows that the FortiGate is sending an 'Authentication-Request' containing the Peer-ID <username> and Password; however, the server responds with an 'Authenticate-Nak' (Message='Login incorrect') with Code: Authenticate-Nak (3) and 'Data: Message: Login incorrect' instead of an 'Authenticate-Ack' message. The server then initiates a Termination Request.

Verify that the username and password are correctly configured.

If the username and password are correct, verification with the PPPoE server team is required to determine why authentication is rejected and why the server responds with the message: 'Login incorrect'.

The PPPoE server team may request entering the service name in the PPPoE connection. See Technical Tip: How to enable service name on PPPOE interface.