The authentication log is completely empty for a device that should be failing. What now?

An empty log is evidence rather than an absence of it. It means no RADIUS request reached us for that device, so nothing at our end refused it — and that narrows the fault to one of two things, both outside Passbeam.

Either the device never answered the network's question, or the switch never asked us. Those need opposite fixes, and the switch's own RADIUS statistics page tells you which: look at its Access-Requests counter. If it is climbing while requests time out, the requests are reaching the internet and being discarded here — check the shared secret, and check the site's registered source address matches where it actually egresses from. If it is **zero**, nothing was ever sent.

A zero counter usually means the device is silent. On Windows that is the Wired AutoConfig service; on a printer or a camera it is often 802.1X enabled but never applied, or a supplicant that only starts on a cold boot, so power-cycle it with the port already enforcing rather than just re-seating the cable.

But do not stop there, because occasionally the switch itself is the silent one. We spent an evening on a printer that we were confident was at fault: the switch's port state read as held, which looks exactly like it had asked and got no answer. It had not asked at all — Access-Requests was zero through every permutation, including a cold boot into an enforcing port. The same printer, same certificate, same secret, on a different manufacturer's switch authenticated on the first attempt.

So read the counter before forming a theory, and if a port authenticates nobody with the counter stuck at zero, try the device on another switch before spending an evening on the device. A port state that says held is not proof that anything was sent.