Strange PPP auth issue on cisco 887VA VDSL

stevenr_robins · ‎08-14-2013

HI.

Was wondering if anyone can help me troubleshoot an issue i have with my Cisco 887VA ISR. The router was working fine when i was on standard dsl connection but now i have upgraded to vdsl i cant get it to connect. The CD light is solid and showing in sync but the PPP part is failing. It seems to hit the PE radius but then fails. I ran a debug ppp authentication and the logs below shows the output:

TheBeast#
Aug 13 18:55:40.763: %SYS-5-CONFIG_I: Configured from console by consolen
Aug 13 18:55:43.383: %DIALER-6-BIND: Interface Vi1 bound to profile Di0
Aug 13 18:55:43.387: %LINK-3-UPDOWN: Interface Virtual-Access1, changed state to up
Aug 13 18:55:43.387: Vi1 PPP: Using dialer call direction
Aug 13 18:55:43.387: Vi1 PPP: Treating connection as a callout
Aug 13 18:55:43.387: Vi1 PPP: Session handle[3F00000B] Session id[11]
Aug 13 18:55:43.435: Vi1 PPP: No authorization without authentication
Aug 13 18:55:43.435: Vi1 CHAP: I CHALLENGE id 1 len 31 from "npe001.ash"
Aug 13 18:55:43.435: Vi1 PPP: Sent CHAP SENDAUTH Request
Aug 13 18:55:43.435: Vi1 PPP: Received SENDAUTH Response FAIL
Aug 13 18:55:43.435: Vi1 CHAP: Using hostname from interface CHAP
Aug 13 18:55:43.435: Vi1 CHAP: Using password from interface CHAP
Aug 13 18:55:43.435: Vi1 CHAP: O RESPONSE id 1 len 24 from "Bob"
Aug 13 18:55:43.675: Vi1 CHAP: I FAILURE id 1 len 43 msg is "CHAP authentication failure, unit 24779"
Aug 13 18:55:43.811: %DIALER-6-UNBIND: Interface Vi1 unbound from profile D0
Aug 13 18:55:43.815: %LINK-3-UPDOWN: Interface Virtual-Access1, changed state to down

Can anyone advise or has had this issue?

paolo bevilacqua · ‎08-14-2013

Aug 13 18:55:43.435: Vi1 CHAP: O RESPONSE id 1 len 24 from "Bob"

Aug 13 18:55:43.675: Vi1 CHAP: I FAILURE id 1 len 43 msg is "CHAP authentication failure, unit 24779"

Wrong credentials, talk to ISP.

stevenr_robins · ‎08-14-2013

Thanks for the response Paolo.

The credentials do not matter, as long as there is some information in the username and password field it will authenticate on the MSAN at the exchange.

I have also tried the full username and password given by the ISP. The connection works with the same username/password on another router (DLink).

I know the username and password are correct as I work in tech support for the ISP that my connection is with. In other words I can check the username and password on the radius internally.

paolo bevilacqua · ‎08-14-2013

You can know everyything about how you ISP authentication works, still the matter stands: you are rejected with a message pointing to authentication and there is nothing you can do about it on cisco.

Ask ISP if they have a MAC lock to the other router address, or leave circuit down for a night or so.

stevenr_robins · ‎08-14-2013

Paolo,

I will check if its locked to MAC but i'm pretty sure it isn't (or shouldn't be) as you can use other routers with this ISP.

see below:

http://help2.talktalk.co.uk/broadband-wireless/supported-devices

A colleague with the same ISP is going to try the router on his connection tonight. He has the same cisco 887VA as I do (with same IOS image and vdsl firmware) to see if it will gain auth on his connection.