Diagnosing a RADIUS Authentication Failure

WayaDesk / FreeRADIUS

When a subscriber cannot authenticate, first establish whether the request reaches the intended service. A rejected request and a request that never arrives require different investigations.

Follow one account through the path

Confirm the subscriber identifier and relevant entitlement. Observe the router attempt, the service’s response and the resulting session state. Use timestamps to connect the observations. Avoid changing multiple credentials or settings at once, because that makes the cause harder to identify.

Check policy before overriding it

A rejection may be the expected result for an expired or suspended account. Confirm the reason before granting access manually. Payment evidence, entitlement and an owner suspension should remain distinct facts in the investigation.

• Use one controlled account with a known service state.
• Check whether the required daemon and bridge are available.
• Compare the expected policy result with what the router receives.

Record the smallest useful evidence

Collect relevant non-secret identifiers, times and outcomes. Do not send shared secrets or subscriber passwords in ordinary support messages. A precise explanation of where the request stops is more useful than an unrestricted export of private configuration.

Verify the repaired journey

After correcting the cause, repeat both an authorised login and a login that should be rejected. Restoring one valid account is not enough if the change accidentally grants access to expired or suspended accounts as well.