Troubleshooting Tip: MS-CHAP-v2, MS-CHAP authentication problems

[jlopeztellez]

Description	This article describes how to troubleshoot authentication with MS-CHAP-v2.
Scope	FortiGate - this article provides a comprehensive guide to troubleshooting authentication issues related to MS-CHAP-v2 (Microsoft Challenge Handshake Authentication Protocol version 2).
Solution	This article describes how to fix the connection between the FortiGate and the RADIUS Server using MS-CHAP-v2. This consists of: Understanding the MS-CHAP-v2 authentication process. Identifying common authentication failures and error codes. Resolving password-related and encryption issues. Go to Modify -> Registry Editor -> Computer\HKEY_LOCAL_MACHINES\SYSTEM\CurrentControlSet\Services\Policy - > Enable NTLMv2Compatibility -> Change the REG_DWORD to 0x00000001(1). RADIUS servers have the default policy enabled to limit NTLM authentication. This can be a common problem when troubleshooting MS-CHAP-v2. Many RADIUS servers enforce policies that limit or restrict NTLM authentication, especially when Kerberos is preferred for security reasons. This has fixed the MSCHAP-v2 issue. The RADIUS Server shows the configuration on the FortiGate has MS-CHAP-v2 enabled. FortiGate now shows the authentication pass.