topic Re: VPN Remote Access - Use PAP instead of MSCHAP in Network Security

VPN Remote Access - Use PAP instead of MSCHAP

ari82 — Fri, 21 Feb 2020 17:31:06 GMT

Hi there,

i'm looking for a way to use PAP instead of MSCHAP for our VPN Remote Access.

We've configured the Authentication with Cisco Anyconnect over an Radius Server (RSA).

RSA couldn't work with MSCHAP so i'm looking for the settings to change the Settings in Firepower Configuration from MSCHAP to PAP

We use FP 6.4 at a 2100 device.

Re: VPN Remote Access - Use PAP instead of MSCHAP

Marvin Rhoads — Tue, 24 Sep 2019 14:44:53 GMT

It appears there is a "hidden" section of the config (only show up with "show run all" that includes the pap setting. As you can see below it is disabled by default:

> show version
---------[ vftd-new.ccielab.mrneteng.com ]----------
Model                     : Cisco Firepower Threat Defense for VMWare (75) Version 6.4.0.5 (Build 23)
UUID                      : 69c94e8a-92d2-11e7-b4ad-db36033706e7
Rules update version      : 2019-09-18-001-vrt
VDB version               : 327
----------------------------------------------------

> show running-config all tunnel-group | begin ppp-attributes
tunnel-group DefaultRAGroup ppp-attributes
 no authentication pap
 authentication chap
 authentication ms-chap-v1
 no authentication ms-chap-v2
 no authentication eap-proxy

I haven't tried it but you may be able to deploy a Flexconfig to change that setting.

Note that PAP is less secure in that the username and password as transmitted in clear text. Kind of ironic for a "secure" VPN.

Re: VPN Remote Access - Use PAP instead of MSCHAP

ari82 — Fri, 27 Sep 2019 12:37:37 GMT

We use a two factor authentication.

So the first step ist to authenticate to again a Radius for Active Directory Authetication.

The second step is to autheticate agains another Radius for Token Authentication.

But for second step it's absolutely necessary to speak PAP.

Of course for our AD Authentication we need MSCHAP.

But there seems to be no way to configure this in Firepower?

Re: VPN Remote Access - Use PAP instead of MSCHAP

Marvin Rhoads — Fri, 27 Sep 2019 12:54:13 GMT

Did you try what I suggested?

Re: VPN Remote Access - Use PAP instead of MSCHAP

ari82 — Fri, 27 Sep 2019 13:07:56 GMT

PAP can be enabled by disable Option "Enable Password Management" in VPN Connection Profile.

But i think, then everthing is running with PAP (also AD Authetication).