Need more info. If the Event is 'Client authentication failed for 00:00:00:00:00:00', with Client MAC Address '00:00:00:00:00:00', then it's possibly a pre-login failure which means the username wasn't passed during the transaction. I see this often with only the reporting controller available. Sometimes we'll see the event and client MAC address filled, but the event trap may not have carried the username.