topic CHAP authentication failure juniper srx in Full Fibre

CHAP authentication failure juniper srx

Mbond65 — Thu, 14 Nov 2024 17:47:09 GMT

Been trying to work out how to setup PPPOE on my SRX320 to work with BT ONT but each time it’s failing Chap authentication according to the logs.

Does anything special need to be done to enable third party router support?

I’ve tried resetting my member centre password, re entering it etc - still getting chap authentication failures on my juniper SRX320.

Username I’m using is: %username%@plusdsl.net

Thanks

Re: CHAP authentication failure juniper srx

MisterW — Thu, 14 Nov 2024 18:35:41 GMT

@Mbond65 Make sure you've not got a VLAN ID se

If that isn't the problem then try setting the 'disable-eol-tag' in the PPPoE options

There was an issue with another router some time ago where it's sending of the eol tag upset the BTw gateway

Re: CHAP authentication failure juniper srx

Mbond65 — Thu, 14 Nov 2024 19:55:16 GMT

Disable eol tag fixed it, thank you so much!

For anyone with a SRX who has the same issue, commands to implement:

[edit]
user@host# set interfaces pp0 unit 0

[edit interfaces pp0 unit 0]
user@host# set pppoe-options ignore-eol-tag

Re: CHAP authentication failure juniper srx

Mav — Thu, 14 Nov 2024 20:54:39 GMT

Moderator's note(s):

Thread moved from Broadband to Full Fibre.

Re: CHAP authentication failure juniper srx

MisterW — Fri, 15 Nov 2024 07:17:22 GMT

@Mbond65 Glad I was able to help and thanks for posting the details, they will be useful for any other Juniper users.

No being a Juniper user myself, I didn't have the exact details but knew from the previous thread (which I can't seem to find at the moment!) that a router sending the 'end-of-list' tag in the CHAP handshake caused a problem.

Re: CHAP authentication failure juniper srx

MisterW — Fri, 15 Nov 2024 07:59:09 GMT

@Mbond65 if you're interested I've found the original thread which discovered the problem https://community.plus.net/t5/My-Router/PPPOE-authentication-with-Plusnet-FTTP-not-working/td-p/1910583

In that case it was a Palo Alto firewall device, and PA modified the firmware to add the option to disable eol. It seems that Juniper already had that option on the SRX series.

Re: CHAP authentication failure juniper srx

Townman — Sat, 16 Nov 2024 10:44:09 GMT

@NickBS

This is a great illustration of the investment of the community into this forum and the value of retaining the historical record for reference and reuse. It’s a fascinating read of stubbornness and teamwork, investigating and eventually resolving a complex issue way outside of PLUSNET’s domain … which would probably have not been achieved without the chemistry and catalyst of all involved.

This was from over a year go … and still delivers value for the few impacted by the scenario.