RADIUS Acct-Terminate-Cause Detailed Meaning, Common Root Causes, and Troubleshooting Notes
What this is: Acct-Terminate-Cause is a RADIUS Accounting attribute (typically in Accounting-Stop packets) indicating why a subscriber session ended. In broadband (PPPoE/IPoE) it is used to classify disconnect reasons for troubleshooting, reporting, and policy enforcement.
1 — User Request
Meaning: The user/CPE intentionally disconnected the session (normal termination from subscriber side).
Possible causes:
• Customer clicked disconnect / ended PPP session from router UI
• CPE reboot initiated by user (power cycle)
• WAN interface disabled/enabled by user
• Customer changed PPPoE settings and re-dialed
What to check (quick):
• CPE uptime and reboot logs
• PPP session logs showing user-initiated terminate
• Customer complaint timing vs local power event
Notes: Often benign; correlate with customer actions or power events.
2 — Lost Carrier
Meaning: The underlying physical link was lost (line drop).
Possible causes:
• Fiber/DSL line issue (low signal, high attenuation, noise)
• Loose/dirty fiber connector; bad patch cord
• Ethernet WAN link down between CPE and ONT/switch
• ONT/ONU went offline (power loss or optical issue)
• Port flapping at access switch/OLT
What to check (quick):
• ONT/ONU optical levels, LOS/LOF alarms (FTTH)
• Interface link up/down counters; flap history
• CRC/FCS errors; negotiation/duplex issues on Ethernet
• Access node alarms around the same time
Notes: Very common for unstable last-mile. If multiple users hit at once, suspect access node or upstream.
3 — Lost Service
Meaning: Service from the network/upstream was lost even if the physical link may still be up.
Possible causes:
• ISP upstream outage or aggregation failure
• BRAS/BNG unreachable from access network
• L2TP tunnel/session failure (where applicable)
• VLAN/service profile removed/misapplied at access device (OLT/DSLAM/switch)
• Routing issues causing loss of service path
What to check (quick):
• BNG/BRAS reachability and alarms
• Aggregation switch uplink status
• Service VLAN mapping and profile on access device
• Any concurrent NOC incident/outage
Notes: Often ISP-side. If many subscribers drop simultaneously, check upstream/core.
4 — Idle Timeout
Meaning: Session terminated because it was idle beyond a configured threshold (no/low traffic).
Possible causes:
• Idle-timeout configured on NAS/BNG or via RADIUS attribute
• Customer not generating traffic for a long time (e.g., device connected but unused)
• Firewall/NAT blocking keepalive traffic in certain environments
• Misconfigured timers causing aggressive idle detection
What to check (quick):
• BNG idle-timeout configuration / RADIUS Idle-Timeout attribute
• Accounting interim updates (traffic counters staying flat)
• CPE logs: WAN up but no traffic due to LAN issue
Notes: Common in enterprise/captive/walled-garden setups; less common in typical home broadband unless configured intentionally.
5 — Session Timeout
Meaning: Session ended because the maximum allowed session time was reached.
Possible causes:
• ISP policy forces re-login every N hours/days (e.g., 24h)
• RADIUS returned Session-Timeout attribute
• Billing or quota system forces periodic session refresh
• Fair usage or reauthorization design
What to check (quick):
• RADIUS Access-Accept attributes (Session-Timeout)
• BNG policy for max session duration
• Does disconnect interval match a fixed pattern (e.g., every 24h)?
Notes: Intentional/policy-driven. Customers typically see predictable periodic reconnects.
6 — Admin Reset
Meaning: Administrator or management system forced the session to disconnect/reset.
Possible causes:
• NOC forced disconnect for troubleshooting
• Subscriber plan/profile updated requiring reauth
• CoA/Disconnect-Message triggered from AAA/PCRF/billing
• Fraud/abuse action requiring immediate session reset
What to check (quick):
• CoA / Disconnect logs on AAA and BNG
• Change records (plan change, profile update)
• AAA audit logs for operator action
Notes: Usually intentional. Correlate with operational actions or billing events.
7 — Admin Reboot
Meaning: Session terminated because a reboot was triggered/initiated by an administrator (device/system reboot event).
Possible causes:
• Planned maintenance reboot of BNG/BRAS
• Access device restart (OLT/DSLAM/aggregation) initiated by operator
• Manual reload after configuration changes
What to check (quick):
• Maintenance window records
• Syslog showing reload reason
• Did many subscribers drop simultaneously?
Notes: If widespread, confirm planned maintenance; if not planned, investigate stability.
8 — Port Error
Meaning: The session ended due to an error condition on the physical/logical port.
Possible causes:
• High interface errors (CRC/FCS) causing instability
• DSL port malfunction; line card issues
• OLT/DSLAM interface fault
• Misconfiguration (speed/duplex mismatch)
• Excessive drops on the access port
What to check (quick):
• Interface error counters (CRC, FCS, drops)
• Port negotiation/duplex status
• Access node port alarms and error logs
Notes: Often points to last-mile or access port quality issues.
9 — NAS Error
Meaning: The NAS/BNG/BRAS encountered an internal error and terminated the session.
Possible causes:
• Software crash/bug impacting session processes
• CPU/memory overload leading to session drops
• Session table/resource exhaustion
• PPP/Subscriber management daemon failure
• RADIUS communication failures causing session cleanup
What to check (quick):
• BNG CPU/memory graphs and alarms
• Crash logs/core dumps; process restarts
• Session scale vs platform limits
• AAA reachability and latency
Notes: ISP infrastructure fault; usually affects multiple subscribers when severe.
10 — NAS Request
Meaning: The NAS itself requested termination (policy/cleanup/logic-driven decision).
Possible causes:
• Duplicate login detected; old session cleared
• Policy enforcement (limits, filters, compliance)
• PPP negotiation failed mid-session
• IP pool or subscriber resource allocation failed after connect
• NAS housekeeping/cleanup triggered
What to check (quick):
• BNG subscriber logs indicating policy reason
• Duplicate session detection counters
• RADIUS attributes and policy maps applied
Notes: Often indicates NAS-side decision rather than physical link failure.
11 — NAS Reboot
Meaning: The NAS rebooted (planned or unplanned), causing session termination.
Possible causes:
• BNG/BRAS reload
• Power failure at ISP site
• Software upgrade / patch installation
• Unexpected crash leading to watchdog reboot
What to check (quick):
• System uptime / reload reason
• Maintenance and incident records
• Subscriber impact scope (number of drops)
Notes: If many subscribers drop at the same timestamp, NAS reboot is a prime suspect.
12 — Port Unneeded
Meaning: The port/session was no longer needed and resources were released (often normal cleanup).
Possible causes:
• Session ended normally and NAS freed port resources
• Customer device disconnected cleanly
• Old session cleanup after reconnection/handover
What to check (quick):
• PPP termination reason on NAS
• Timing relative to user reconnection attempts
Notes: Can look similar to User Request depending on vendor behavior.
13 — Port Preempted
Meaning: The port/session was taken over by another session or higher priority connection.
Possible causes:
• Second login from same account replaced the first
• Policy allows only one concurrent session; old one preempted
• Rapid reconnect causing previous session to be cleared
• PPPoE session takeover behavior on NAS
What to check (quick):
• Concurrent session limits for the user
• Logs showing second session start near stop time
• Customer CPE repeatedly re-dialing
Notes: Common in multiple-login or unstable CPE re-dial loops.
14 — Port Suspended
Meaning: Port was suspended temporarily by policy/management.
Possible causes:
• Account placed on hold / temporary suspension
• Quarantine due to security policy
• Pending verification or partial authorization state
• Network enforcement action without full disable
What to check (quick):
• AAA policy flags / subscriber state
• Security/NAC events
• Billing/account status
Notes: More common in managed enterprise/NAC environments than typical home broadband.
15 — Service Unavailable
Meaning: Requested service could not be provided; session terminated as service delivery failed.
Possible causes:
• IP pool exhausted / no addresses available
• Missing VLAN/service profile mapping
• AAA returned incomplete/incorrect attributes
• NAS resource shortage preventing service setup
• Upstream outage prevents establishing service
What to check (quick):
• IP pool utilization and failures
• Service profile/VLAN provisioning
• RADIUS response attributes; policy evaluation logs
Notes: Often provisioning or resource-related; can affect many users when pools are depleted.
16 — Callback
Meaning: Session ended because callback mechanism was triggered (legacy dial-up feature).
Possible causes:
• Legacy dial-up/remote-access callback configuration
Notes: Rare in modern broadband PPPoE/FTTH networks.
17 — User Error
Meaning: Session ended due to user-side configuration or protocol errors.
Possible causes:
• Incorrect PPP username/password format (in some designs, may appear elsewhere too)
• Wrong MTU/MRU causing negotiation or traffic failure
• Misconfigured PPPoE client settings
• CPE firmware issues causing protocol errors
• LAN-side issues leading to repeated session resets
What to check (quick):
• CPE PPP logs (LCP/IPCP failures)
• MTU/MRU settings and PPPoE overhead
• Try different CPE to isolate
Notes: Often CPE-related; verify with a known-good router.
18 — Host Request
Meaning: Termination requested by a remote host/system (AAA/PCRF/billing/policy controller).
Possible causes:
• Billing system expired plan / quota reached and forced disconnect
• AAA sent disconnect request/CoA
• Policy controller enforced new rule requiring reconnect
• Subscriber suspended due to non-payment/abuse
What to check (quick):
• AAA/billing logs at the termination timestamp
• CoA/Disconnect-Message traces
• Account/package validity and quota status
Notes: Very common in prepaid/quota-based broadband or when policy requires immediate enforcement.
19 — Supplicant Restart
Meaning: Client restarted authentication/supplicant process (PPPoE client restart or 802.1X supplicant restart).
Possible causes:
• Router restarted PPPoE process due to connectivity checks
• CPE firmware bug triggers reauth loop
• 802.1X supplicant reset (enterprise access)
• User changed WAN settings, causing client restart
What to check (quick):
• CPE logs: PPPoE process restart events
• Frequency/pattern of restarts
• Try firmware upgrade or alternate CPE
Notes: If frequent, suspect unstable CPE software or WAN health-check features.
20 — Reauthentication Failure
Meaning: Reauthentication occurred but failed; session terminated.
Possible causes:
• Credentials invalid at reauth time (account changed/disabled)
• RADIUS server unreachable or timing out
• Policy requires reauth and AAA rejects/does not respond
• Intermediate network issues preventing AAA exchange
What to check (quick):
• AAA availability and latency around the time
• RADIUS logs for rejects/timeouts
• Account status changes mid-session
Notes: Common in environments with periodic reauth (802.1X, captive portals, strict policy).
21 — Port Reinitialized
Meaning: Port was reset/reinitialized by system (link may momentarily drop/reset).
Possible causes:
• Access switch/OLT port reset
• Interface flap due to configuration change
• Auto-negotiation restart or port bounce event
• Line card reset
What to check (quick):
• Port flap history and admin actions
• Access device logs for port reset events
Notes: Often indicates access-layer events. If many users affected, check access node.
22 — Port Administratively Disabled
Meaning: Port was shut down by an administrator or management policy.
Possible causes:
• OLT/DSLAM/Access switch interface shut (subscriber disabled)
• Account suspension triggers port disable
• Security action: abuse/fraud block
• Provisioning changes disabling the port/VLAN
What to check (quick):
• Access device config history
• AAA/account status and suspension reason
• NOC tickets or automation logs
Notes: Almost always intentional admin action; verify with provisioning/billing systems.
23 — Lost Power
Meaning: Power loss caused termination (customer or ISP side).
Possible causes:
• Customer premises power outage (CPE/ONT off)
• ISP POP/site power failure (BNG/access node off)
• UPS failure or battery depleted
What to check (quick):
• ONT/CPE last-seen time and power alarms
• ISP site power alarms/UPS logs
• Did multiple subscribers in same area drop?
Notes: Determine location by scope: single user suggests CPE/ONT; many suggests node/site power.
24 — Reauthentication Required
Meaning: Session ended because policy required reauthentication (forced disconnect to re-login).
Possible causes:
• Policy requires periodic re-login to refresh authorization
• Subscriber profile/plan changed mid-session
• Captive portal requires re-login
• Accounting sync enforcement
What to check (quick):
• AAA policy configuration and timers
• Recent subscriber profile changes
• Captive portal/policy controller logs
Notes: Policy-driven; users may see periodic or event-driven disconnects.
Quick Troubleshooting View (Most Useful)
Customer-side most likely:
• 1 User Request
• 2 Lost Carrier
• 17 User Error
• 19 Supplicant Restart
• 23 Lost Power
ISP-side most likely:
• 6 Admin Reset
• 7 Admin Reboot
• 9 NAS Error
• 11 NAS Reboot
• 15 Service Unavailable
• 22 Port Administratively Disabled
Policy / AAA driven:
• 5 Session Timeout
• 18 Host Request
• 24 Reauthentication Required
Tip: Always correlate the terminate-cause with other accounting fields like Acct-Session-Time, input/output octets, NAS/IP, and timestamps. If you see the same cause hitting many users at the same time, it is usually an ISP-side event (core/access node, AAA outage, or maintenance).