Using Radius Authentication Peap-MSCHAPv2 for PA Management Interface Error: 400

[MangLai]

Hi Guys, 

I was trying to add Peap-MSchapV2 for our Radius Authentication for Management Interface. 

I configured Radius Server Profile with PAP with Windows NPS, seems everything is working fine. And then I generate a new Certificate Signing request and signed by Organisations CA server, and downloaded the intermediate certificate etc and uploaded to PA and Testing Domain Windows 10 Machine. Once I switched to Peap-MsChapV2, the whole management interface is down for the error 400 SSL bad request. had to log in to CLI and delete the management profile and put it back. 

Thanks,

Mang

Wondering if anyone successfully configured management interface with authentication Radius "Peap MsChapv2"? We just want to have some Domain Admin Users to be able to log into PA to manage etc. Or we have to use Tacacs+ for this feature? 

Thanks

Mang

[JayGolf]

Hi @MangLai ,

Thanks for your post. Could you share a screenshot of your Radius server profile? 

[OtakarKlier]

Hello,

Might have been the certificate profile since the certificate was changed? Also I would not recommend using a domain admin account to log onto the Palo Alto. Create new credentials that only log onto the firewall. I know its a pain to have multiple accounts, however its best practice so separate accounts and functions.

Regards,