When a router does not authenticate

Work through these in order. Each step either finds the problem or rules out a whole layer.

Start with the live log

Open Log → RADIUS Log and have one subscriber try to connect.

• A line appears with a reason — the router reaches the service; jump to Rejected subscribers.
• Nothing appears — the request is not arriving; go to The tunnel.

The tunnel

Under Routers (NAS), check the router shows online. If it does not:

1. Check the router's clock with /system clock print. A wrong date breaks the tunnel before anything else, and it is the usual cause on a router that was powered off for a while.
2. Check the RouterOS version matches what you picked when you generated the script. RouterOS 6 refuses version 7 commands, and the rest of the script then does not run.
3. Paste the script again. It is safe to repeat: it replaces its own lines instead of adding duplicates.
4. On RouterOS 7.2x, if the tunnel comes up and then drops, use the script as generated; a hand-edited copy often misses the connection-tracking rule the tunnel needs.

Unknown device

If the log says the device is unknown or the company could not be found, the request came from an address that is not the one registered for this router. This happens with two internet lines, or a NAT in front of the router.

The router list shows the address each router was last seen from and marks a mismatch. Make the router send its RADIUS traffic from the registered address, or correct the address on the router's record.

Rejected subscribers

The reason is on the log line. The common ones:

• Wrong password — the log shows why it did not match.
• Expired or no plan — activate the subscriber or attach a plan.
• Disabled — enable the subscriber.
• Subscriber limit reached — your subscription allows a number of subscribers; contact us to raise it.
• Maintenance — the service is in maintenance; connections resume when it ends.

If PAP logins work and PPPoE logins do not, tell us: that is a configuration problem on our side, not yours.

Usage is not counting

If subscribers connect but their usage stays at zero, the router is not sending accounting.

• In /radius print, the entry must include accounting.
• In /ppp aaa print, accounting must be on, with an interim update set.
• Keep the idle timeout at least twice the interim interval, or quiet sessions are closed as stale.

Look from inside the router

The router's page opens a remote console through the tunnel, with no port forwarding. /radius monitor 0 shows whether requests are sent and answered, and /log print shows the router's own view.

What to send us

If none of this finds it, open a ticket with: the router's name, the time of one failed attempt, the subscriber's username, and the RADIUS Log line for it.