PIX 515e and IAS RADIUS Authenication Question..

[lloydt]

I have setup a PIX 515e with group VPN. It authenticates to a WIndows Server 2003 IAS RADIUS installation. To configure this I performed the following;

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00800b6099.shtml#configuringthemicrosoftserverwithias

The only difference in my solution is the VPN client is 4.0 (maybe there is added support now?)

Per Cisco. However, this method only allows PAP|SPAP authentication method which doesn't support encryption.

Without using a CA or configuring "VPN Pass-through" is there any way to increase the authentication to a more secure protocol like MSChap v2? If there isn't how secure am I and should I setup specific users for VPN only?

TIA!

[gfullage]

The Radius traffic between the PIX and the IAS server will still have the password encrypted based on the shared key that you have set up on each device, this is standard Radius.

The PIX will receive the users password over the Phase 1 IKE tunnel so this is safe as it passes over the Internet. It will then pass that password to the internal Radius server as a standard PAP password, but as I said, Radius will encrypt that section of the packet that contains the password automatically.