07-10-2024 03:07 AM
Hi.
I am trying to use Cisco ASA for VPN connections.
I want to authenticate users by RADIUS server using only MS-CHAPv2.
When using PAP, everything works.
After enabling "password-management" in my RADIUS log I see:
Invalid user: [vpnuser/<no User-Password attribute>]
Why? What can I do?
My tunnel-group config:
tunnel-group DefaultRAGroup general-attributes
authentication-server-group REMOTE
password-management
tunnel-group DefaultRAGroup ppp-attributes
no authentication chap
no authentication ms-chap-v1
authentication ms-chap-v2
tunnel-group DefaultWEBVPNGroup general-attributes
address-pool VPN_Pool
authentication-server-group REMOTE
password-management
tunnel-group DefaultWEBVPNGroup ppp-attributes
no authentication chap
no authentication ms-chap-v1
authentication ms-chap-v2
07-15-2024 05:05 AM
I dont think it ASA issue it radius issue'
Did you check radius auth config' as I mention?
You need to allow both encrypt chap and ms-chap-v2
MHM
07-15-2024 11:41 PM
I am not gonna change radius to please Cisco ASA. Radius is used by something else primarly.
07-16-2024 01:26 AM
Cisco sends Access-Request correctly. It's either misconfiguration on the RADIUS server or the server is buggy. I believe that currently you're using CHAP, rather than MS-CHAPv2, and hence password-management (password change feature) doesn't actually work for you.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide