Cisco’s protocol “AnyConnect-EAP” uses PAP for authentication?

[Mike-Zimmermann]

Hi,

I am using the Cisco’s proprietary protocol AnyConnect-EAP for double-authentication (username/pw and machine certificate) together with an external Windows 2019 radius server. The authentication works, but why communicates the router only over PAP with the radius server? Is there a possibility to change it to CHAP or so?

Thx!

[MHM Cisco World]

PAP is one way auth, and CHAP is two way auth meaning the Server must auth by client.