PPPoE customer can't connect

Symptoms

The customer’s router shows the PPPoE connection as disconnected, or as “authentication failed”.
On a MikroTik CPE, /interface pppoe-client print detail shows a status other than connected.
The customer connects, but every website sends them to your Expired PPPoE notice.
PPPoE → Sessions doesn’t list the customer.

Start with the auth log

Go to PPPoE → Auth Logs and filter by the customer’s Username, or by MAC Address. Each login attempt is listed with its Reply and a Reason:

Access-Accept (green): ISPMan accepted the login. If the customer is still offline, the problem is on the router or the line. Skip to Router and line checks.
Access-Reject (red): ISPMan refused the login. The Reason column tells you why.
No rows at all: the attempt never reached ISPMan. The router serving that customer may be offline, or its PPPoE server isn’t set up to use ISPMan.

Reject reasons and fixes

Reason in the auth log	What it means	Fix
`PPPoE password mismatch` / `Invalid password`	The password on the customer’s router doesn’t match ISPMan.	On the customer’s page, open Customer Credentials to see the current details, or click Password to set a new one. Then type it into the customer’s router exactly, with no spaces. Usernames are case-sensitive.
`Customer not found`	No customer with that username exists.	Check the username for typos. If the customer was never added or imported, add them under Services → PPPoEs.
`Router MAC address not matching customer MAC address (registered: …, dialing from: …)`	MAC binding is on and the customer has replaced their router.	On the customer’s page, open Manage MAC Binding Policy and click Clear MAC. The new router is learned on the next login. You can also allow specific MACs or a prefix.
`No more session allowed (max concurrent sessions reached)`	The account is already online, often a stale session.	Click Reset Customer Connection on the customer’s page, or raise the limit with Change Customer Max Connections.
`Connected with Limited Connection because customer is …` (for example `expired`)	The router is connected, but only to a limited, walled-garden connection, because the account is expired, unpaid or disabled.	The customer needs to pay, or you can Connect them by hand. Their browser shows your Expired PPPoE notice in the meantime.
`PPPoE subscription expired`	The subscription has run out.	As above: payment, or a manual Connect (with Grace Period if they’ll pay later).

Account checks

Open the customer from Customers → PPPoE and check:

Active or deactivated? Accounts that stay expired past your PPPoE Deactivation Policy grace period are deactivated. Click Activate to turn the account back on, then renew it.
Expiry date: if it’s in the past, the customer gets the limited connection.
Router device: with the Strict device assignment policy on (see the PPPoE Authentication Policies card in Settings), the customer can only dial in through the router assigned to them. Use Change Router Device if they’ve moved.
Sessions: an active session somewhere else means the account is already in use.

Router and line checks

If the log shows Access-Accept but the customer has no internet, or the log shows nothing:

Is the PPPoE router online? Check Devices → All Devices → Last Seen. See Router shows offline.
Run the router’s config check. On the device page, click Run Config Check. It checks RADIUS and, if PPPoE has been used in the last 7 days, the PPPoE firewall rules. Click Apply Fix on anything it finds.
On the customer side: check the cable or fibre, and the ONT’s PON/LOS lights. Power off the ONT and router, wait 30 seconds, then start the ONT first.
After the session comes up, ping 8.8.8.8 from the customer’s router. If that fails while PPPoE shows connected, check the default route on the customer’s router (Add Default Route).

Common CPE messages:

Router says	Usually means
“Authentication failed” / error 691	Wrong username or password. See the table above.
“Account disabled” / error 718	The account is suspended or expired.
“No response from server”	The PPPoE server isn’t reachable: a line problem, or the router serving the customer is down.
“Session limit reached”	The account is already online elsewhere.

Policies that affect everyone

In Settings, the PPPoE Authentication Policies card has three switches that apply to all customers: Enable MAC binding check (global), Enforce PPPoE password and Strict device assignment. If many customers suddenly start failing after a change, check these first. Only admins and owners can change them.

When to contact support

Contact support if:

Rejects show a reason that isn’t listed here.
No customer on a router can authenticate, while the router is online and Run Config Check is clean.

Include the username, the router name and the time of an attempt from the auth log. See Communication.