topic Cisco ISE 3.1 (patch3) speaks with Active directory using ntlmv1 in Network Access Control

Cisco ISE 3.1 (patch3) speaks with Active directory using ntlmv1

milos_p — Wed, 10 Aug 2022 08:44:11 GMT

Hi guys,

I am getting logs on DC that there is NTLMv1 communication from ISE server:

I can see this communication happening when Windows computer authenticates to ISE from WiFi network using PEAP (EAP-MSCHAPv2) with computer authentication. Looks like ISE takes MSCHAPv2 information and sends it to domain controller as NTLMv1 request, and I want it to be NTLMv2 due to the company security policy.

part of log: Protocol: Ntlm, IsNtlmV1: True, NtlmV1Count: 1

Apart from settings in Passive ID section to use ntlmv1 or ntlmv2 (ntlmv2 is checked, but we are NOT using passive ID), I cannot find anywhere to specify/force Cisco ISE to use ntlmv2 and not ntlmv1 when it speaks with DC to authenticate users coming from 802.1x networks.

Is there a way to force the use of ntlmv2 towards DCs, for EAP authentications (PEAP EAP-MSCHAPv2 in my case) coming from users?

Thanks a lot in advance!

Milos

Re: Cisco ISE 3.1 (patch3) speaks with Active directory using ntlmv1

Greg Gibbs — Wed, 10 Aug 2022 22:05:35 GMT

MSCHAPv2 is NTLMv1 based. I'm not aware of a way to 'force' the protocol to use NTLMv2 when used with EAP, hence the known issues caused by MS Defender Credential Guard. Microsoft's recommendation is to use EAP-TLS instead.

Re: Cisco ISE 3.1 (patch3) speaks with Active directory using ntlmv1

milos_p — Thu, 11 Aug 2022 07:05:50 GMT

Hi Greg,

Thanks for clarification, I assumed something like that is happening.

On the other side, although like you said MSCHAPv2 is by default NTLMv1 based, Microsoft enabled possibility in their RADIUS server (NPS) to use strictly NTLMv2 when NPS speaks with DC:

https://docs.microsoft.com/en-US/troubleshoot/windows-server/networking/rras-vpn-connections-fail-ms-chapv2-authentication

Is there some possibility like this in ISE, using Active Directory advanced tuning configuration?

Case is, this is big thing from Security Department perspective, as NTLMv1 raise some red flags.

Thanks a lot!

Milos

Re: Cisco ISE 3.1 (patch3) speaks with Active directory using ntlmv1

Greg Gibbs — Thu, 11 Aug 2022 22:47:18 GMT

The VPN use case is completely different than the EAP use case, hence, the specific phrasing I used when I said "I'm not aware of a way to 'force' the protocol to use NTLMv2 when used with EAP".

This is a limitation of the protocol and the client supplicant, which is not something any configuration in ISE can change.

Re: Cisco ISE 3.1 (patch3) speaks with Active directory using ntlmv1

milos_p — Fri, 12 Aug 2022 07:26:29 GMT

Hi Greg,

I really was hoping there is some hidden/advanced parameter that can force ISE to use NTLMv2 for this case.

Thanks again for great explanation and discussion!

Regards,

Milos