Technical Tip: RADIUS authentication using MS-CHAPv2 fails

[dbhavsar]

Description	This article describes how to mitigate authentication using MS-CHAPv2 fails for Windows RADIUS servers.
Scope	FortiGate.
Solution	Check the connectivity, and make sure FortiGate can telnet/ping the RADIUS server. Try authenticating using the default authentication method. All the methods will work except the ms-chapv2. To authenticate using the mschapv2, add the following registry key in the Windows Servers registry. Select Start -> Run, type regedit in the Open box, and then select OK. Locate and select the following registry subkey: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\RemoteAccess\Policy On the Edit menu, point to New, and then select DWORD Value. Type Enable NTLMv2 Compatibility, and then press ENTER. On the Edit menu, select Modify. In the Value data box, type 1, and then select OK. Exit Registry Editor. Windows article:  https://learn.microsoft.com/en-gb/troubleshoot/windows-server/networking/rras-vpn-connections-fail-m... If the network policies are configured, then make sure that authentication is allowed using the ms-chapv2 method. The below screenshots show that authentication is successful: