Panorama and PANOS RADIUS Authentication Failing after upgrade to 10.2

BKRogers — Thu, 05 Jan 2023 15:24:47 GMT

Hello,

Thought I would pass on this solution I found. After upgrading our Panorama from 10.1 to 10.2, our RADIUS authentication no longer worked. The root cause was our Microsoft RADIUS server was using TLS 1.0 for the PEAP-MSCHAP TLS handshake and 10.2 REQUIRES TLS 1.1.

The solution is to add the following registry setting to your Microsoft NPS server

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RasMan\PPP\EAP\13

add a DWORD TlsVersion with a hex value of 0x3C0

then reboot.

This value will allow the MS NPS server to negotiate TLS 1.0 and TLS 1.1.

You probably DONT want to enable TLS 1.2 yet. I found enabling TLS 1.2 will cause 10.1 PANOS to fail the RADIUS handshake.

Re: Panorama and PANOS RADIUS Authentication Failing after upgrade to 10.2

fwmike2 — Thu, 25 Jul 2024 18:09:02 GMT

Thanks @BKRogers!
Found no mention of this behavior change in release notes or known issues.

topic Re: Panorama and PANOS RADIUS Authentication Failing after upgrade to 10.2 in Panorama Discussions

Panorama and PANOS RADIUS Authentication Failing after upgrade to 10.2

Re: Panorama and PANOS RADIUS Authentication Failing after upgrade to 10.2