topic Re: Palo Alto RADIUS authentication against Microsoft NPS is broken in General Topics

Palo Alto RADIUS authentication against Microsoft NPS is broken

nwsol — Mon, 05 Oct 2015 07:19:51 GMT

Has anyone managed to get authentication on PAN-OS 7.0 working with microsoft NPS servers?

Since version 7.0 authentication against our microsoft NPS radius servers is broken. Because the firewall now always first tries CHAP instead op PAP (see this article) and microsoft NPS always replies with a ACCESS-REJECT massage (see this article -> item 9).

As it's insane to start storing our AD credentials with reversible encryption I guess microsoft NPS isn't compatible anymore with Palo Alto? Or am I missing something here?

Re: Palo Alto RADIUS authentication against Microsoft NPS is broken

pankaku — Mon, 05 Oct 2015 08:35:47 GMT

I have configure radius authentication with NPS and it works perfect. I am using 7.0.2

Re: Palo Alto RADIUS authentication against Microsoft NPS is broken

nwsol — Mon, 05 Oct 2015 08:44:13 GMT

What are the settings of your policy? I've enable only PAP as an allowed authentication method.

I can't figure out how to trigger the PAP failover on palo alto. It keeps on using CHAP which isn't supported on our domain.

Re: Palo Alto RADIUS authentication against Microsoft NPS is broken

pankaku — Mon, 05 Oct 2015 08:55:10 GMT

I have followed this video

https://www.youtube.com/watch?v=1yYywwPWXys

Re: Palo Alto RADIUS authentication against Microsoft NPS is broken

nwsol — Mon, 05 Oct 2015 09:05:35 GMT

Oh, so you are running the windows 2012 version of NPS?

We're running it on 2008 R2. It might be there's a behaviour change between the 2 windows versions.

Re: Palo Alto RADIUS authentication against Microsoft NPS is broken

BLH — Mon, 05 Oct 2015 10:51:36 GMT

Are you using the NPS for administrator or GlobalProtect access?

What version of PAN-OS?

What does the Event Viewer on the NPS say? Event Viewer -> Server Roles -> Network Policy Server

Re: Palo Alto RADIUS authentication against Microsoft NPS is broken

nwsol — Mon, 05 Oct 2015 11:33:22 GMT

We're using it for admin access on PAN-OS 7.0.2.

NPS logs give an error (19): No reversibly encrypted password is stored for the user account. This means you should enable reversible encryption on you domain controllers with the policy setting "Store password using reversible encryption for all users in the domain" which is not something we can do.

Packet captures show only 1 request and an ACCESS-REJECT radius reply from NPS (because of the CHAP). So no second attempt by the firewall.using PAP

Re: Palo Alto RADIUS authentication against Microsoft NPS is broken

BLH — Mon, 05 Oct 2015 11:52:14 GMT

Is the Network Policy (or Connection Request Policy, if using overrides), specifically configured to only allow PAP?

Re: Palo Alto RADIUS authentication against Microsoft NPS is broken

nwsol — Mon, 05 Oct 2015 11:59:50 GMT

Yes, The NPS settings are exactly the same as on your screenshot. I also see you're running windows server 2012.

Maybe 2012 does not reply on CHAP requests triggering a timeout, while 2008 replies with an access-reject?

Re: Palo Alto RADIUS authentication against Microsoft NPS is broken

BLH — Mon, 05 Oct 2015 13:02:19 GMT

All versions of NPS (2008 <-> 2012 R2) should behave the same way.

Dump below is from a 2012 R2. First a CHAP request is sent, that is rejected, and then PAP is tried.

The Event Viewer will also indicate two logins. Subsequent logins are only sent using PAP though.

Might be worth a shot to re-create the RADIUS server profile on the firewall.

What does a Wireshark trace from the NPS look like?

The whole CHAP implementation in 7.0 is pretty silly. The failover only works half the time for the inital logins, it causes massive issues with Multi Factor Authentication solutions using RADIUS Challenge/Response, there's no tickbox to turn it off and completely baffling that CHAP, instead of MS-CHAPv2 is supported..

Re: Palo Alto RADIUS authentication against Microsoft NPS is broken

nwsol — Mon, 05 Oct 2015 13:42:24 GMT

Recreating the RADIUS server profile did the trick. (actually, changed the timeout and retry from 3 to 2 and pushed from panorama). The system log now says it switched to PAP for that radius server.

That's a nasty bug... Never would have tought 'touching' the radius config could fix the issue...

Re: Palo Alto RADIUS authentication against Microsoft NPS is broken

BLH — Mon, 19 Oct 2015 14:27:49 GMT

Found this issue on another firewall (Panorama 7.0.2) - I could also resolve it by modifying the RADIUS configuration. Great find!

Re: Palo Alto RADIUS authentication against Microsoft NPS is broken

BLH — Wed, 23 Dec 2015 06:17:09 GMT

Woop woop.. From the PAN-OS 7.0.4 release notes:

Added a new CLI operational command ( set authentication radius-auth-type <auto|chap|pap> ) to address an incompatibility issue between PAN-OS and some RADIUS servers. With this fix, you can manually override the automatic selection mechanism introduced with Challenge-Handshake Authentication Protocol (CHAP) support in PAN-OS 7.0 to select either CHAP or Password Authentication Protocol (PAP) as needed.

TLDR; CLI command set authentication radius-auth-type <auto|chap|pap>

Re: Palo Alto RADIUS authentication against Microsoft NPS is broken

rbista — Fri, 25 Dec 2015 01:29:33 GMT

Thank you. But, it looks like it can be done only via CLI, how about configuring CHAP from GUI?

Re: Palo Alto RADIUS authentication against Microsoft NPS is broken

rbista — Fri, 25 Dec 2015 01:37:51 GMT

Well, even from the CLI, it doesn't seem to take the command.

rbista@MyFirewall> configure
Entering configuration mode
[edit]
rbista@MyFirewall# set authentication radius-auth-type chap

Invalid syntax.
[edit]
rbista@MyFirewall#

Any suggestions? I ran the command # find command keyword "radius-auth-type", it display the command though.

rbista@MyFirewall> find command keyword "radius-auth-type"
set authentication radius-auth-type <auto|chap|pap>
rbista@MyFirewall>

Re: Palo Alto RADIUS authentication against Microsoft NPS is broken

pankaku — Fri, 25 Dec 2015 09:51:15 GMT

What is the PAN-OS on the firewall?

Re: Palo Alto RADIUS authentication against Microsoft NPS is broken

pankaku — Fri, 25 Dec 2015 10:34:06 GMT

It will work on PAN-OS 7.0.4. You dont have to go in configure mode.

admin@fw63> set authentication radius-auth-type chap

Hope this helps!

Merry Christmas 🙂