Palo Alto RADIUS authentication against Microsoft NPS is broken

[nwsol · Accepted solution]

Recreating the RADIUS server profile did the trick. (actually, changed the timeout and retry from 3 to 2 and pushed from panorama). The system log now says it switched to PAP for that radius server.

That's a nasty bug... Never would have tought 'touching' the radius config could fix the issue...

[BLH]

Found this issue on another firewall (Panorama 7.0.2) - I could also resolve it by modifying the RADIUS configuration. Great find!

[BLH]

Woop woop.. From the PAN-OS 7.0.4 release notes:

Added a new CLI operational command ( set authentication radius-auth-type <auto|chap|pap> ) to address an incompatibility issue between PAN-OS and some RADIUS servers. With this fix, you can manually override the automatic selection mechanism introduced with Challenge-Handshake Authentication Protocol (CHAP) support in PAN-OS 7.0 to select either CHAP or Password Authentication Protocol (PAP) as needed.

TLDR; CLI command set authentication radius-auth-type <auto|chap|pap>

[rbista]

Thank you. But, it looks like it can be done only via CLI, how about configuring CHAP from GUI? 

[rbista]

Well, even from the CLI, it doesn't seem to take the command. 

rbista@MyFirewall> configure
Entering configuration mode
[edit]
rbista@MyFirewall# set authentication radius-auth-type chap

Invalid syntax.
[edit]
rbista@MyFirewall# 

Any suggestions? I ran the command # find command keyword "radius-auth-type", it display the command though. 

rbista@MyFirewall> find command keyword "radius-auth-type"
set authentication radius-auth-type <auto|chap|pap>
rbista@MyFirewall>

[pankaku]

What is the PAN-OS on the firewall?

[pankaku]

It will work on PAN-OS 7.0.4. You dont have to go in configure mode.

admin@fw63> set authentication radius-auth-type chap

Hope this helps!

Merry Christmas :)