topic EAP is an authentication in Network Access Control

ISE Anyconnect Active Directory EAP-MSCHAP not allowed

asigachev — Mon, 11 Mar 2019 05:44:19 GMT

Hello everyone

Trying to configure Anyconnect Remote-Access VPN with ASR1000, ISE and Active Directory and facing the following problem:

the authentication is failing with the following messages on ISE:

11001	Received RADIUS Access-Request
	11017	RADIUS created a new session
	15049	Evaluating Policy Group
	15008	Evaluating Service Selection Policy
	15048	Queried PIP - Network Access.Device IP Address
	15006	Matched Default Rule
	11507	Extracted EAP-Response/Identity
	12300	Prepared EAP-Request proposing PEAP with challenge
	11006	Returned RADIUS Access-Challenge
	11001	Received RADIUS Access-Request
	11018	RADIUS is re-using an existing session
	11801	Extracted EAP-Response/NAK requesting to use EAP-MSCHAP instead
	11803	Failed to negotiate EAP because EAP-MSCHAP not allowed in the Allowed Protocols
	11504	Prepared EAP-Failure
	11003	Returned RADIUS Access-Reject

while EAP-MSCHAP is clearly allowed int the Authentication Policy

The authentication policy matching sequence is

Authentication Policy

RAVPN1 >> Default

Allowed protocols list named TEST:

Is there anything else that needs to be enabled/permitted?

It worked perfectly with local users authentication and EAP-MD5.

Update: looks like the only mode working is EAP-MD5 (with local users, AD doesn´t support it). Trying to use EAP-GTC with both local and AD identity sources fails with the same message saying EAP-GTC is not permitted by Allowed Protocols List while the protocol IS being permitted.

Update: It looks like ISE is declaring PEAP expecting to perform MS-CHAPv2 as inner method and AnyConnect Client says MS-CHAPv2 directly, so the systems fail to negotiate.

ISE says PEAP:

12300 Prepared EAP-Request proposing PEAP with challenge

AnyConnect responds, "no, I want EAP-MSCHAP":

11801 Extracted EAP-Response/NAK requesting to use EAP-MSCHAP instead

Which is weird, because EAP-MSCHAP IS actually MSCHAP inside PEAP or EAP-FAST. I suppose there is no such thing as using EAP-MSCHAP instead of PEAP, but inside of it.

If I choose EAP-MD5 it works, because EAP-MD5 is declared as EAP-MD5 by both sides. The problem is you can't youse EAP-MD5 with Active Directory, only with local users.

Is there any way to overcome this?

Are you using the AD

jan.nielsen — Tue, 19 May 2015 18:31:54 GMT

Are you using the AD connector in ISE or LDAP to connect to AD ?

AD connector. (AD Join

asigachev — Tue, 19 May 2015 19:22:59 GMT

AD connector. (AD Join feature)

Sounds strange, is your

jan.nielsen — Thu, 21 May 2015 21:28:33 GMT

Sounds strange, is your AnyConnect VPN setup using SSL or IKEv2 ?

Maybe try to remove all thos unneeded protocols, so only mschap_v2 is the only on left in your authentication allowed protocols list.

I use IKEv2-IPSEC.I tried to

asigachev — Fri, 22 May 2015 12:22:25 GMT

I use IKEv2-IPSEC.

I tried to remove all the unneded protocols. There is an option to leave EAP-MSCHAP under PEAP or under EAP-FAST, I tried both. In first case ISE proposes PEAP and Anyconnect responds with EAP-MSCHAP and negotiation fails, in the second case same thing happens with EAP-FAST.

Have you ever seen the solution working?

The thing is as far as I remember when you set up EAP authentication on Wireless LAN controller for example, you have setting options very similar to the ones you have on ISE, i.e. PEAP with MS-CHAP inside or EAP-FAST with MS-CHAP. So during the negotiation ISE proposes PEAP, WLC responds PEAP, they agree and then all the MS-CHAP exchange goes inside. In the case of Anyconnect VPN client you have no option to choose between PEAP and EAP-FAST, it is just EAP-MSCHAPv2 option.

Hello, I'm facing the same

decode.chr13 — Fri, 09 Oct 2015 06:12:09 GMT

Hello,

I'm facing the same problem.

Did you manage to solve this?

Thank you

EAP is an authentication

waynesymes — Fri, 09 Oct 2015 15:02:52 GMT

EAP is an authentication framework, not a specific authentication mechanism. ISE is fully IETF compliant RADIUS server. MSCHAP is not a IETF supported inner method for EAP, however MD5 is analogous to the PPP CHAP protocol, so EAP-MD5 could be used. The EAP method's defined IETF RFC's are EAP-MD5, EAP-POTP, EAP-GTC, EAP-TLS, EAP-IKEv2, EAP-SIM, EAP-AKA and EAP-AKA'. The commonly used modern methods capable of operating in wireless networks include EAP-TLS, EAP-SIM, EAP-AKA, LEAP and EAP-TTLS. PEAP (Protected EAP) has two IETF defined inner methods (PEAPv1) EAP-GTC, MSCHAPv2 (PEAPv0). There are also many vendor specific EAP types outside of these.

Hi waynesymes, I agree with

decode.chr13 — Fri, 09 Oct 2015 15:43:08 GMT

Hi waynesymes,

I agree with you that ALL vendors should follow and be compliant with a RFC/draft/etc, but as we all know is not always the case in this world.

I would gladly use EAP-MD5 even if is collision and MITM prone, if I would have one of the following tools:

a) A sharp tool to determine Microsoft to accept MD5 challenge in user auth.

b) A tool to export/import AD users (including updates of password or account status) through ERS in ISE

As I don't have either one, I'm trying to make AD happy, ISE happy and me happy 🙂

Now, leaving the joke aside, the problem, I think, resides in ISE as long as me and asigachev checked the EAP-FAST/PEAP with MSCHAPv2 method, but when authentication occurs, ISE says is not checked.

It is also true that in every configuration guide involving FlexVPN, IOS/IOS XE and Anyconnect client, when MSCHAPv2 was mentioned there was always a Microsoft Radius configured and never saw ISE. Now I wonder why...

Hi, Cristi

asigachev — Mon, 02 Nov 2015 17:10:03 GMT

Hi, Cristi

Looks like I am on my way. Will update soon.

So, basically, we had to

asigachev — Tue, 03 Nov 2015 12:45:31 GMT

So, basically, we had to upgrade the router IOS so we got anyconnect-eap method support. For our platform which is ASR1000 we went to 15.5(3)S (03.16.00.S)

The TAC engineer says it works, I didn't have time to test it yet, so if you try it, please post the result here.

crypto ikev2 profile AC
 match identity remote key-id cisco.com
 identity local dn 
 authentication remote anyconnect-eap aggregate
 authentication local rsa-sig
 pki trustpoint my.verisign.trustpoint
 dpd 60 2 on-demand
 aaa authentication anyconnect-eap AC
 aaa authorization user anyconnect-eap cached
 virtual-template 40

And here is the profile used

<?xml version="1.0" encoding="UTF-8"?>
<AnyConnectProfile xmlns="http://schemas.xmlsoap.org/encoding/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://schemas.xmlsoap.org/encoding/ AnyConnectProfile.xsd">
<ClientInitialization>
<UseStartBeforeLogon UserControllable="true">false</UseStartBeforeLogon>
<AutomaticCertSelection UserControllable="true">true</AutomaticCertSelection>
<ShowPreConnectMessage>false</ShowPreConnectMessage>
<CertificateStore>All</CertificateStore>
<CertificateStoreOverride>false</CertificateStoreOverride>
<ProxySettings>Native</ProxySettings>
<AllowLocalProxyConnections>false</AllowLocalProxyConnections>
<AuthenticationTimeout>12</AuthenticationTimeout>
<AutoConnectOnStart UserControllable="true">false</AutoConnectOnStart>
<MinimizeOnConnect UserControllable="true">true</MinimizeOnConnect>
<LocalLanAccess UserControllable="true">false</LocalLanAccess>
<ClearSmartcardPin UserControllable="true">false</ClearSmartcardPin>
<IPProtocolSupport>IPv4</IPProtocolSupport>
<AutoReconnect UserControllable="false">true
<AutoReconnectBehavior UserControllable="false">ReconnectAfterResume</AutoReconnectBehavior>
</AutoReconnect>
<AutoUpdate UserControllable="false">true</AutoUpdate>
<RSASecurIDIntegration UserControllable="false">Automatic</RSASecurIDIntegration>
<WindowsLogonEnforcement>SingleLocalLogon</WindowsLogonEnforcement>
<WindowsVPNEstablishment>LocalUsersOnly</WindowsVPNEstablishment>
<AutomaticVPNPolicy>false</AutomaticVPNPolicy>
<PPPExclusion UserControllable="false">Automatic
<PPPExclusionServerIP UserControllable="false"></PPPExclusionServerIP>
</PPPExclusion>
<EnableScripting UserControllable="false">false</EnableScripting>
<EnableAutomaticServerSelection UserControllable="true">false
<AutoServerSelectionImprovement>20</AutoServerSelectionImprovement>
<AutoServerSelectionSuspendTime>4</AutoServerSelectionSuspendTime>
</EnableAutomaticServerSelection>
<RetainVpnOnLogoff>false
</RetainVpnOnLogoff>
<AllowManualHostInput>true</AllowManualHostInput>
</ClientInitialization>
<ServerList>
<HostEntry>
<HostName>YOURHOSTNAME</HostName>
<HostAddress>x.x.x.x</HostAddress>
<PrimaryProtocol>IPsec
<StandardAuthenticationOnly>true
<IKEIdentity>cisco.com</IKEIdentity>
</StandardAuthenticationOnly>
</PrimaryProtocol>
</HostEntry>
</ServerList>
</AnyConnectProfile>

Hi,

Cristi Romano — Wed, 04 Nov 2015 11:02:04 GMT

Hi,

We will test it tonight and update here.

Authentication method in Anyconnect, I guess it must be: EAP-Anyconnect.

Authentication protocol in ISE, must be? I'll check them all anyway to see which one it picks up.

Thanks,

Authentication protocol on

asigachev — Wed, 04 Nov 2015 14:01:38 GMT

Authentication protocol on ISE is PAP in our case.

I have just tested and it works, I will try to reproduce all the configuration one more time later.

One more important thing I have just noticed in the solution proposed is that you have to change the Anyconnect Client local policy to bypass client update download, otherwise the client fails to establish the connection saying "The VPN client failed to establish a connection"

Open the file C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\AnyConnectLocalPolicy.xml

and change <BypassDownloader> option to True.

Hi,

Cristi Romano — Thu, 05 Nov 2015 11:07:13 GMT

Hi,

I also noticed auth proto is PAP. Wonder if it can be changed.

We've done the following steps:

1) Upgraded to 3.16.

2) Used your config, but noticed that we need to add to your suggested config:

crypto ikev2 profile AC
match identity remote key-id $AnyConnectClient$

otherwise the router would not pick any profile and throw an error that no matching profile was found. Is this also your situation?

3) Anyconnect now:

- connects to router

- asks for user/pass

- router sends info to ISE

- ISE succesufully authenticates and sends back to router: Authorization: Permit

- router then needs some info that does not get or understands:

<some of the data>

004419: Nov 5 08:12:34.093 EET: IKEv2:(SESSION ID = 58,SA ID = 1):Config-type: Config-request
004420: Nov 5 08:12:34.093 EET: IKEv2:(SESSION ID = 58,SA ID = 1):Attrib type: ipv4-addr, length: 0
004421: Nov 5 08:12:34.093 EET: IKEv2:(SESSION ID = 58,SA ID = 1):Attrib type: ipv4-netmask, length: 0
004422: Nov 5 08:12:34.093 EET: IKEv2:(SESSION ID = 58,SA ID = 1):Attrib type: ipv4-dns, length: 0
004423: Nov 5 08:12:34.093 EET: IKEv2:(SESSION ID = 58,SA ID = 1):Attrib type: ipv4-nbns, length: 0
004424: Nov 5 08:12:34.093 EET: IKEv2:(SESSION ID = 58,SA ID = 1):Attrib type: unknown, length: 0
004425: Nov 5 08:12:34.093 EET: IKEv2:(SESSION ID = 58,SA ID = 1):Attrib type: app-version, length: 32, data: AnyConnect Darwin_i386 4.0.00048
004426: Nov 5 08:12:34.093 EET: IKEv2:(SESSION ID = 58,SA ID = 1):Attrib type: ipv4-subnet, length: 0

<...>

004467: Nov 5 08:12:34.094 EET: IKEv2-ERROR:IKEv2 responder - unsupported attrib unknown in cfg-req
004468: Nov 5 08:12:34.094 EET: IKEv2-ERROR:IKEv2 responder - unsupported attrib unknown in cfg-req
004469: Nov 5 08:12:34.094 EET: IKEv2-ERROR:IKEv2 responder - unsupported attrib unknown in cfg-req
004470: Nov 5 08:12:34.094 EET: IKEv2-ERROR:IKEv2 responder - unsupported attrib unknown in cfg-req
004471: Nov 5 08:12:34.094 EET: IKEv2-ERROR:IKEv2 responder - unsupported attrib reconnect-cleanup-interval in cfg-req
004472: Nov 5 08:12:34.095 EET: IKEv2-ERROR:IKEv2 responder - unsupported attrib unknown in cfg-req
004473: Nov 5 08:12:34.095 EET: IKEv2-ERROR:IKEv2 responder - unsupported attrib unknown in cfg-req
004474: Nov 5 08:12:34.095 EET: IKEv2-ERROR:IKEv2 responder - unsupported attrib reconnect-dpd-interval in cfg-req
004475: Nov 5 08:12:34.095 EET: IKEv2-ERROR:IKEv2 responder - unsupported attrib unknown in cfg-req
004476: Nov 5 08:12:34.095 EET: IKEv2-ERROR:IKEv2 responder - unsupported attrib unknown in cfg-req

<...>

Would it be possible to share here your full config (including: aaa, virtual-template, crypto ikev2, crypto ipsec)?

"sh run | sec aaa|crypto ikev2|crypto ipsec|^interface Virtual-Template"

Did you set anything else on ISE for Authorization, except Permit?

Thanks,

CR

PS: I don't know how to move this conversation to private (email/private message) and come back here with final result.

Have you edited the

asigachev — Thu, 05 Nov 2015 12:41:23 GMT

Have you edited the AnyconnectLocalPolicy? Because the problem looks similar to what we had before doing that.

I have send you part of the ASR config by mail.

I did edit the

Cristi Romano — Thu, 05 Nov 2015 22:48:05 GMT

I did edit the AnyconnectLocalPolicy.xml:

<BypassDownloader>true</BypassDownloader>

I compared my config with yours and they look similar.

The main difference is that i really need to have:

match identity remote key-id $AnyConnectClient$

instead of:

match identity remote key-id cisco.com

I'm still stuck at the latest output:

IKEv2-ERROR:IKEv2 responder - unsupported attrib unknown in cfg-req

I found another guy with the same problem 6 months ago, not even a reply 🙂

https://supportforums.cisco.com/discussion/12500956/flexvpn-ras-anyconnect-certificates

Still debuging. I'll update when I figure out what is wrong.

Found out that those error

Cristi Romano — Thu, 05 Nov 2015 23:22:49 GMT

Found out that those error messages are also in the debug output of a working profile (EAP-MD5). So, those are not necesarly a problem.

I found out though:

007761: Nov 6 01:11:12.962 EET: IKEv2:(SESSION ID = 96,SA ID = 1):Error in settig received config mode data
007762: Nov 6 01:11:12.962 EET: IKEv2:(SESSION ID = 96,SA ID = 1):Auth exchange failed
007763: *Nov 6 01:11:12.962 EET: IKEv2-ERROR:(SESSION ID = 96,SA ID = 1):: Auth exchange failed

Have you tried removing

asigachev — Sun, 08 Nov 2015 00:29:46 GMT

Have you tried removing special characters from key-id?

just to check if this could be a problem...

I did, but anything you do to

Cristi Romano — Mon, 09 Nov 2015 10:21:44 GMT

I did, but anything you do to that string, results in no profile matching:

009801: *Nov  9 12:09:37.254 EET: IKEv2:(SESSION ID = 110,SA ID = 1):Searching policy based on peer's identity '*$AnyConnectClient$*' of type 'key ID'
009802: *Nov  9 12:09:37.254 EET: IKEv2-ERROR:% IKEv2 profile not found
009803: *Nov  9 12:09:37.258 EET: IKEv2-ERROR:(SESSION ID = 110,SA ID = 1):: Failed to locate an item in the database
009804: *Nov  9 12:09:37.258 EET: IKEv2:(SESSION ID = 110,SA ID = 1):Verification of peer's authentication data FAILED
009805: *Nov  9 12:09:37.258 EET: IKEv2:(SESSION ID = 110,SA ID = 1):Sending authentication failure notify

Hello,

cisartomas — Tue, 26 Jul 2016 10:01:34 GMT

Hello,

we are facing the same problem. Ikev2 , Anyconnect and the EAP-MSCHAPv2 authC method.

Its sad, that Cisco is not able to authenticate the IKEv2 clients (MSCHAPv2) on the routers with the ISE/ACS combination at all. The only possible way is the TLS method. I don't think that MD5 authentication is secured algorithm nowadays.

Another way is used the Cisco ASA. FW is capable to authenticate the EAP-MSCHAPv2 clients with the ISE/ACS in the background.

Based on my research, Cisco released the official bug ID :

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuw99531/?referring_site=bugquickviewclick

Enhancement = miracle 🙂

Usually our customers migrate their remote access solution from Ikev1 to ikev2 and the already have ACS/ISE. They are wondering, that they need to change the authentication process of the clients or they need to deploy another RADIUS AuthC server.....

topic EAP is an authentication in Network Access Control

ISE Anyconnect Active Directory EAP-MSCHAP not allowed

Are you using the AD

AD connector. (AD Join

Sounds strange, is your

I use IKEv2-IPSEC.I tried to

Hello, I'm facing the same

EAP is an authentication

Hi waynesymes, I agree with

Hi, Cristi

So, basically, we had to

The TAC engineer says it works, I didn't have time to test it yet, so if you try it, please post the result here.

Hi,

Authentication protocol on

Hi,

Hi,

I also noticed auth proto is PAP. Wonder if it can be changed.

We've done the following steps:

1) Upgraded to 3.16.

2) Used your config, but noticed that we need to add to your suggested config:

crypto ikev2 profile AC match identity remote key-id *$AnyConnectClient$*

otherwise the router would not pick any profile and throw an error that no matching profile was found. Is this also your situation?

3) Anyconnect now:

- connects to router

- asks for user/pass

- router sends info to ISE

- ISE succesufully authenticates and sends back to router: Authorization: Permit

- router then needs some info that does not get or understands:

<some of the data>

<...>

<...>

Would it be possible to share here your full config (including: aaa, virtual-template, crypto ikev2, crypto ipsec)?

"sh run | sec aaa|crypto ikev2|crypto ipsec|^interface Virtual-Template"

Did you set anything else on ISE for Authorization, except Permit?

Thanks,

CR

PS: I don't know how to move this conversation to private (email/private message) and come back here with final result.

Have you edited the

I did edit the

I did edit the AnyconnectLocalPolicy.xml:

<BypassDownloader>true</BypassDownloader>

I compared my config with yours and they look similar.

The main difference is that i really need to have:

match identity remote key-id *$AnyConnectClient$*

instead of:

match identity remote key-id cisco.com

I'm still stuck at the latest output:

IKEv2-ERROR:IKEv2 responder - unsupported attrib unknown in cfg-req

I found another guy with the same problem 6 months ago, not even a reply 🙂

https://supportforums.cisco.com/discussion/12500956/flexvpn-ras-anyconnect-certificates

Still debuging. I'll update when I figure out what is wrong.

Found out that those error

Found out that those error messages are also in the debug output of a working profile (EAP-MD5). So, those are not necesarly a problem.

I found out though:

007761: *Nov 6 01:11:12.962 EET: IKEv2:(SESSION ID = 96,SA ID = 1):Error in settig received config mode data007762: *Nov 6 01:11:12.962 EET: IKEv2:(SESSION ID = 96,SA ID = 1):Auth exchange failed007763: *Nov 6 01:11:12.962 EET: IKEv2-ERROR:(SESSION ID = 96,SA ID = 1):: Auth exchange failed

Have you tried removing

I did, but anything you do to

I did, but anything you do to that string, results in no profile matching:

Hello,

crypto ikev2 profile AC
match identity remote key-id $AnyConnectClient$

match identity remote key-id $AnyConnectClient$

007761: Nov 6 01:11:12.962 EET: IKEv2:(SESSION ID = 96,SA ID = 1):Error in settig received config mode data
007762: Nov 6 01:11:12.962 EET: IKEv2:(SESSION ID = 96,SA ID = 1):Auth exchange failed
007763: *Nov 6 01:11:12.962 EET: IKEv2-ERROR:(SESSION ID = 96,SA ID = 1):: Auth exchange failed