Overview

When an ONT WAN interface remains in the Connecting state indefinitely under PPPoE mode, the root cause typically resides in the PPPoE discovery or authentication phase rather than the physical optical layer. For B2B telecom engineers and network architects, this symptom points to a breakdown in the PADI/PADO handshake, a CHAP authentication rejection, or a configuration mismatch such as VLAN ID or service name. This FAQ addresses the most common pre-sales and post-sales technical queries surrounding this failure mode, providing actionable diagnostic pathways from CLI session verification to upstream access concentrator troubleshooting.

Frequently Asked Questions

Q1: Why does the ONT WAN PPPoE session stay in Connecting state and never reach UP?

The ONT WAN remains in Connecting because the PPPoE client has either not received a valid PADO offer from the access concentrator or has failed CHAP authentication after session establishment. In Huawei-based ONT CLI, run display pppoe-client session summary to verify the session state; a persistent IDLE or PADI state indicates the upstream PPPoE server is unreachable or not responding to discovery requests . If the state reaches PADR/PADS but drops before UP, the failure shifts to LCP negotiation or authentication credential validation .

Q2: What optical interface conditions would prevent PPPoE discovery from completing?

The optical interface must report an UP physical state with valid receive optical power before PPPoE frames can traverse the link. Execute display ip interface brief on the ONT to confirm the WAN physical interface is UP/UP; if the interface is administratively down or protocol down, PPPoE PADI frames will never egress toward the OLT . Additionally, verify the PON optical module RX power falls within the -8 dBm to -27 dBm compliant range; values below -27 dBm indicate fiber attenuation or connector contamination that may cause intermittent discovery packet loss without a complete link down .

Q3: How do I distinguish between a PPPoE discovery failure and a CHAP authentication failure from CLI logs?

A discovery failure manifests as repeated PADI transmissions with no PADO response, visible in packet captures or debug logs as recurring timeout events. A CHAP authentication failure, by contrast, shows the PPP session reaching the authentication phase before the server returns a reject message; in OpenWrt-based systems, the log explicitly states CHAP authentication failed followed by session termination . For B2B ONT platforms, enable PPPoE debug logging and inspect whether the failure occurs before or after the PADS session confirmation packet; pre-PADS failures are discovery-layer issues, while post-PADS failures are authentication or IPCP negotiation issues .

Q4: What VLAN configuration errors cause the PPPoE session to hang in Connecting?

An incorrect or missing VLAN ID on the ONT WAN interface is a primary cause of PPPoE discovery timeout because the access concentrator cannot match the PADI frame to the correct service domain. Many ISPs require a specific VLAN tag for PPPoE sessions; for example, Deutsche Telekom mandates VLAN 7 for internet access, while certain regions require VLAN 201 or 35 . Verify the ONT WAN VLAN binding against ISP provisioning documentation; if the VLAN is correct but the session still hangs, confirm that the ONT is not double-tagging or stripping the VLAN before forwarding the PADI frame toward the OLT.

Q5: Does MAC address binding on the ISP side affect PPPoE Connecting status?

MAC address binding typically applies to DHCP-based WAN connections rather than PPPoE sessions, because PPPoE authentication relies on username and password credentials rather than link-layer identity. However, some ISP access concentrators implement MAC-based session limits or anti-spoofing checks that may silently discard PADI frames from an unrecognized ONT MAC address, causing the Connecting state to persist . If credential verification passes on a directly connected PC but fails on the ONT, test MAC cloning on the ONT WAN interface using the previously working device MAC address as a diagnostic step, though this is not a standard requirement for PPPoE .

Q6: What CLI commands should I run on a B2B ONT to diagnose PPPoE Connecting failures?

The first diagnostic step is display pppoe-client session summary to inspect the session state and identify whether the client is stuck in IDLE, PADI, or PADR phases . Second, run display ip interface brief to confirm the WAN physical interface and protocol status are both UP. Third, enable PPPoE packet debugging or capture traffic on the WAN interface to verify that PADI frames are being transmitted and whether any PADO responses arrive; absence of PADO indicates an upstream reachability or VLAN mismatch issue . Finally, check the ONT system log for CHAP or PAP authentication failure messages if the session reaches the authentication stage.

Q7: How does the ONT WAN PPPoE Connecting issue differ from DHCP mode failures?

In DHCP mode, a Connecting state typically indicates the ONT is waiting for a DHCP OFFER that never arrives, often due to MAC binding, upstream server unavailability, or incorrect port mode . In PPPoE mode, the failure occurs at the PPP layer and involves a two-stage process: discovery (PADI/PADO/PADR/PADS) followed by session negotiation (LCP, authentication, IPCP). DHCP failures resolve at Layer 2/3 address assignment, while PPPoE failures may persist even when Layer 2 connectivity is fully functional because the access concentrator may be reachable but actively rejecting the session due to credential or service-name mismatches .

Q8: What upstream ISP-side conditions can cause indefinite PPPoE Connecting that the ONT cannot resolve locally?

Upstream conditions including access concentrator resource exhaustion, BRAS port configuration errors, and stale session hold-down timers can cause indefinite Connecting that no ONT-side configuration change will fix. If the ONT PADI frames are confirmed egressing the WAN interface with correct VLAN tagging but no PADO response arrives, the fault lies with the ISP access network or the AC's ability to process discovery requests . Additionally, if the previous PPPoE session was not cleanly terminated (for example, due to an ONT reboot without sending PADT), the ISP may hold the session open for a timeout period of 3 to 5 minutes; waiting for this interval before redialing is a valid diagnostic step .