Is MSCHAP possible with aaa radius authentication?

[DavidvanWijck05094]

We have a MS NPS server for Radius to handle aaa with users in AD.

It works fine when we use no encryption.
It does not seem to work when we enable MSCHAP on the MS Server.
Is this even possible?

[M02@rt37]

Hello @DavidvanWijck05094 

Do you check PEAP-MSCHAPv2 ?

[DavidvanWijck05094]

No only mschap en mschapv2

[M02@rt37]

@DavidvanWijck05094 

MS-CHAPv2 without PEAP is not secure.

MS-CHAP and MS-CHAPv2 require access to plaintext or reversibly encrypted passwords in active directory. Since AD doesn't store user passwords in plaintext by defaut, authentication will fail unless you enable "Store Password Using Reversible Encryption".

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh994559(v=ws.11)

[DavidvanWijck05094]

Does this work on a Cisco 9500/9300/9200 with aaa for management with mschap via NPS Radius?

[M02@rt37 · Accepted solution]

Hello @DavidvanWijck05094 

MSChap-V2 is used for user authentication like dial-in and vpn and not for switch management...

For managing your switches, the recommended approach is to use RADIUS with PAP or CHAP authentication methods. These methods are compatible with Cisco IOS for console, SSH, or Telnet access.

But also, consider using TACACS+ instead of RADIUS. Unlike RADIUS, which encrypts only the password, TACACS+ encrypts the entire authentication process, including both username and password, providing a more secure authentication mechanism.

So, TACACS+ for device administration and RADIUS for secure network access​:

source: CCNP ENCOR 350-401_Chapter 26: Network Device Access Control and Infrastructure Security

[DavidvanWijck05094]

.