topic Re: Microsoft Radius Authentication with PA in General Topics

Microsoft Radius Authentication with PA

umar00o — Sun, 01 Mar 2020 10:37:51 GMT

Hi,

I am trying to setup Radius Authentication with PA. I have setup EAP(PEAP) and EAP-MSCHAP v2 on the windows radius server. However I can only login to the firewall using PAP. I have tried to import the certificate from the radius server but not sure why I can't use the EAP or MSCHAP options.

Please advice as I am not sure if I am exporting and importing the certificate corretly.

Thanks

Re: Microsoft Radius Authentication with PA

BPry — Mon, 02 Mar 2020 01:07:58 GMT

@umar00o,

You need to ensure that the root and intermediate certificates are included in the certificate profile assigned to your RADIUS server profile. You sure that you have the certificate profile configured correctly?

Re: Microsoft Radius Authentication with PA

umar00o — Mon, 02 Mar 2020 09:10:28 GMT

Hi,

Thanks for your reply, well I think I am doing it correctly. Any one has a guide with images which I can use?

Re: Microsoft Radius Authentication with PA

OleksM — Mon, 02 Mar 2020 14:48:01 GMT

Hi !

I used this link https://drive.google.com/file/d/1_wjjrIILr2akt63ueUIK-xAq9zPwGqWw/view

but it isn't helped me.

In my case PAP auth also works, but MS-CHAP - doesn't.

I've generated Digicert, imported it into NPS Radius local machine storage (private key end CA) on PA GP I've created a

proper profile linked to Digicert CA.

Please, advise.

Re: Microsoft Radius Authentication with PA

umar00o — Mon, 02 Mar 2020 15:22:03 GMT

Hi OleksM,

We both having same issues.

Thanks

Re: Microsoft Radius Authentication with PA

BhargavTelaprolu — Fri, 17 Apr 2020 17:31:11 GMT

Do you guys think there are limitations for Administrator authentication which only supports "PAP" by any of the vendors like Microsoft/Pulse Secure Radius etc..

I am not able to find any of the vendors in the industry that supports EAP encryption on top of PAP or CHAP. Like EAP-TTLS with PAP

Any vendors do you think supports EAP-TTLS with PAP for Firewall Admin authentication ? NOT for global protect as radius client. Here firewall itself is a radius client.

Re: Microsoft Radius Authentication with PA

jhovik — Sat, 11 Sep 2021 00:29:44 GMT

I use Aruba ClearPass with EAP-TTLS with PAP works fine for admin login.