Setup Radius Authentication for administrator in Palo Alto

[wong.raymond]

I tried to setup Radius in ISE to do the administrator authentication for Palo Alto Firewall. I have the following security challenge from the security team.

Both Radius/TACACS+ use CHAP or PAP/ASCII

By CHAP – we have to enable reversible encryption of password which is hackable .

  https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption

By PAP/ASCII – the password is in pain text sending between the Radius server and the Palo Alto. It is insecure.

If I wish to use Cisco ISE to do the administrator authentication , what is the recommended authentication method that we can use? Thanks

[gbekmezi-DD]

Does this help?

https://www.cisco.com/c/en/us/td/docs/security/ise/2-0/admin_guide/b_ise_admin_guide_20/b_ise_admin_guide_20_chapter_01101.html

[hslai]

ISE can do IPSec -- Configure ISE 2.2 IPSEC to Secure NAD (IOS) Communication - Cisco

Else, ensure the communications between ISE and the NADs are on a separate network.