Cisco AAA RADIUS - What Authentication Protocol Does It Use?

[Mike Mertens]

We use RADIUS for authenticating network admins logging into routers/switches. We use a Windows Server 2019 running NPS as our RADIUS server, which is apparently using NTLMv1 on the back end to authenticate to LDAP/AD. We need to move off of NTLMv1 (per Windows admin) but I am not familiar with the NPS configuration. Anyway, diving deeper into RADIUS, and I found and think I understand that the RADIUS server (or client?) can use NLTMv1, PAP, CHAP, MS-CHAP, EAP, EAP-TLS for authorization. So then, I should be able to reconfigure the NPS for RADIUS with something other than NTLM. However, that got me wondering: What does a Cisco router/switch configured for using RADIUS under AAA use to pass the user/password to the RADIUS server? What is the default config method, and how can I modify this? So when I SSH to a switch, the switch prompts me for userid/password, which is encrypted in SSH, but how do I see the encryption method for the switch-to-RADIUS server communication?

It seems the more I read, the more I'm getting confused.

Thanks for any clarification anyone can bring.

Mike

[M02@rt37]

Hello @Mike Mertens 

Which RADIUS authentication method do you expect to use ?

[Mike Mertens]

I guess "anything but NTLMv1", as that is what the Windows team is trying to retire. I'm quite confused right now as it seems that between the Windows NPS and AD/LDAP it is RADIUS with NTLMv1(?) and then I wonder: does that mean that RADIUS is using NTLMv1 between router/switch and the NSP RADIUS server? Or are these RADIUS "Access-Request", "Access-Accept", "Access-Reject" messages are application-layer on top of UDP being used between Cisco router/switch to the NPS/RADIUS server, then NPS is using NTLMv1between it and AD/LDAP?

THANKS!

Mike

Preview

[MHM Cisco World · Accepted solution]

SW/R--radius--NPS (server)--NTLM--LDAP server 

So between SW/R and NPS there is only radius protocol.

MHM

[Karsten Iwen · Accepted solution]

The Authentication protocol from the RADIUS client (the switch/router) to the RADIUS server (your NPS) is PAP/ASCII. What happens between the NPS and the Directory-server depends heavily on the environment.