Rejected Diameter authentication continuation that does not match its pending challenge

Logged when a NASREQ or Diameter EAP request carries the Session-Id of a pending local authentication challenge but does not match it: it arrived from another peer or with different origin or destination identities, user, or Auth-Request-Type, it carries the wrong EAP identifier or NASREQ State, the round was already answered, or the challenge cannot accept another response yet. Radiator Server answers DIAMETER_AUTHENTICATION_REJECTED (4001) and keeps the pending challenge for the matching response.

Check the logged peer for retransmissions or reused Session-Ids. An occasional occurrence after a client retransmission is harmless; repeated occurrences from one peer indicate that it does not keep Session-Id, routing identities, and EAP or State values consistent across challenge rounds.