topic Re: EAP-TLS Vs MSCHAPV2 in Network Access Control

EAP-TLS Vs MSCHAPV2

alliasneo1 — Fri, 07 Feb 2025 12:16:41 GMT

Hi all, I just wanted some advice.

When implementing ISE, what is thre recommended authentication method for clients? Is it EAP-TLS or MSCHAPv2?

Re: EAP-TLS Vs MSCHAPV2

Rob Ingram — Fri, 07 Feb 2025 12:55:24 GMT

@alliasneo1 EAP-TLS is the recommended authentication method nowadays. If you use EAP-TLS for machine and user authentication you can use TEAP to provide EAP Chaining and make authentication more secure.

PEAP/MSCHAPv2 does not work when credential guard is enabled on Windows 10/11 devices, thus Microsoft recommends EAP-TLS https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/considerations-known-issues

Re: EAP-TLS Vs MSCHAPV2

Flavio Miranda — Fri, 07 Feb 2025 12:31:29 GMT

@alliasneo1

They are complementary. You need both at the end of the day.

EAP-TLS buids the encrypted tunnel between the supplicant and the authenticator and t" (MS-CHAPv2) is a password-based authentication protocol that verifies a user's identity when connecting to a network"