topic Re: CHAP/MD5 support on ISE in Network Access Control

CHAP/MD5 support on ISE

umahar — Thu, 25 Jan 2018 18:42:52 GMT

Hi,

We are trying to authenticate Huawei to ISE using radius and device authentication.

It seems Huawei used CHAP/MD5 and not the usual PAP-ASCII like Cisco and Juniper.

Is this method supported by ISE as we are seeing the below error and we have enabled all auth types?

Re: CHAP/MD5 support on ISE

thomas — Thu, 25 Jan 2018 19:21:36 GMT

If you go into ISE > Policy > Policy Elements > Results > Authentication > Allowed Protocols you can see the list of all available protocols that you may choose from.

Please try CHAP and see it works for you.

Also please note the limited set of of Identity Stores that you may use it with in the ISE 2.3 Administrators Guide on page 329:

Please let us know if you're successful!

Re: CHAP/MD5 support on ISE

umahar — Thu, 25 Jan 2018 19:24:13 GMT

Thanks Thomas, We have enabled everyone of them but its not working.

I wonder if CHAP/MD5 is different than CHAP.

Re: CHAP/MD5 support on ISE

thomas — Thu, 25 Jan 2018 19:29:19 GMT

Thank you for that, Utkarsh. Can you tell us which Huawei platform(s) and software versions you're testing with?

Re: CHAP/MD5 support on ISE

umahar — Thu, 25 Jan 2018 19:32:43 GMT

Hi Thomas,

Below is the output.

>dis ver

Huawei Versatile Routing Platform Software

VRP (R) software, Version 5.130 (S9300 V200R003C00SPC500)

Quidway S9303 Terabit Routing Switch uptime is 90 weeks, 1 day, 19 hours, 16 minute

Re: CHAP/MD5 support on ISE

thomas — Thu, 25 Jan 2018 19:38:37 GMT

Are there no other protocol options for MAB with Huawei?

Re: CHAP/MD5 support on ISE

umahar — Thu, 25 Jan 2018 19:47:31 GMT

This is to authenticate users logging into Huawei for device administration.

I've asked the customer to look for other protocols.

Re: CHAP/MD5 support on ISE

thomas — Thu, 25 Jan 2018 21:05:22 GMT

I spoke with Utkarsh and to clarify the scenario is using CHAP/MD5 for TACACS+ Device Administration and not RADIUS-based MAB authentication.

They are trying to use CHAP/MD5 with RADIUS as a workaround for the lack of TACACS+ support.

Re: CHAP/MD5 support on ISE

umahar — Mon, 29 Jan 2018 19:47:13 GMT

Hi Thomas,

The customer made some changes on their test switch and are now using PAP-ASCII which is working.

Not sure if they are willing to make that change in all of their Huawei switches.

I am not sure if Huawei lacks Tacacs+ but the reason why they are sticking to radius is because they don't want to make major changes in their environment as they are currently on Freeradius and only want to switch the IP to ISE.