topic Re: RADIUS authentication: MS-CHAP v2? in General Topics

RADIUS authentication: MS-CHAP v2?

scottsander — Tue, 21 Jun 2016 21:20:29 GMT

Currently, my PA-3050 devices (PAN-OS 6.1.12) utilize RADIUS authentication. I know that this uses the completely unencrypted PAP protocol.

I have asked PAN about MS-CHAP v2 support in the past and was told that the device must be placed into FIPS mode in order to gain the ability to do RADIUS authentication over MS-CHAP v2, but by putting a device into FIPS mode you are effectively performing a factory reset.

I've always thought that was completely ridiculous. If the device supports MS-CHAP v2 in FIPS mode, it's clearly capable of using the protocol. Why not make MS-CHAP v2 available in standard mode as a choice over PAP?

In any case, I've seen that PAN has removed the FIPS mode from newer PAN-OS releases. As such, is PAN adding MS-CHAP v2 support? Or are they dropping MS-CHAP v2 support entirely along with the associated FIPS mode?

Re: RADIUS authentication: MS-CHAP v2?

Raido_Rattameister — Tue, 21 Jun 2016 22:19:28 GMT

v7.0 supports CHAP

https://live.paloaltonetworks.com/t5/Management-Articles/CHAP-preferred-over-PAP-while-sending-RADIUS-access-request-PAN/ta-p/58014

Re: RADIUS authentication: MS-CHAP v2?

scottsander — Wed, 22 Jun 2016 13:41:33 GMT

Well, I guess it's good that they have finally moved beyond PAP, but it's a shame they aren't using MS-CHAP v2 which is the most secure RADIUS authentication protodcol available.

Re: RADIUS authentication: MS-CHAP v2?

Jack_Howells — Thu, 23 Jun 2016 10:31:25 GMT

Hi Scottsander,

As CHAP has only just been implemented, I'm sure MS-CHAP v2 is around the corner. I'm sure you could also speak to your account manager to raise this as a Feature request to add in future releases.

Thanks

Jack

Re: RADIUS authentication: MS-CHAP v2?

scottsander — Thu, 23 Jun 2016 20:49:16 GMT

I already did that three years ago.