- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
About Supported EAP methods in Fortinac
Hello team.
As far as I understand in 802.1x authentication there are two mechanism evolved to authenticate supplicant. The outer method than encapsulates and secure the eap messages (like PEAP and TTLS) and inner methods (like PAP and CHAP and ms-chap-v2).
I can see that PEAP can be used along with mschapv2 and this is clear when I configure the supplicant.
However, I am not sure what mschapv2 means when it is listed among other methods in Fortinac RADiUS configuration as outer method. And can mschapv2 used alone in 802.1x and how can I configure the supplicant correctly to use it.
Solved! Go to Solution.
- Labels:
-
FortiNAC
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Using MSCHAPv2 without PEAP is not secure and should not be used, even if old supplicants support it. Windows supplicant and FNAC support both EAP PEAP or TTLS that can be used with user credentials.
EAP-TLS is the recommended version and as it seems will be the only protocol supported for future version of Windows 11.
If you have found a solution, please like and accept it to make it easily accessible for others.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello @Akmostafa ,
You can find supported methods on Fortinac below. For mschapv2 you can select both outer methods. In my experience generally, everyone uses peap/mschapv2.
- Supported 802.1x EAP methods:
- TTLS/PAP: Handles authentication requests through
- LDAP servers defined in FortiNAC
- RADIUS servers defined in FortiNAC
- Local Users (including guests) in the FortiNAC database
- TTLS/MSCHAPv2: Authenticates AD Users only
- FortiNAC must join the domain
- Limited to one domain
- PEAP/MSCHAPv2: Authenticates AD Users only
- FortiNAC must join the domain
- Limited to one domain
- TLS: Authenticates UserPrincipalName SAN User from the certificate
- Requires the Endpoint Trust Certificate to be installed so FortiNAC can validate the client-side certificate. For installation instructions see Certificate management.
- FAST: Flexible Authentication via Secure Tunneling
- PAC Opaque Key
- Allow Anonymous In-Band PAC Provisioning
- Allow Authenticated In-Band PAC Provisioning
- TTLS/PAP: Handles authentication requests through
https://docs.fortinet.com/document/fortinac/9.4.0/administration-guide/450544/local-radius-server
NSE 4-5-6-7 OT Sec - ENT FW
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Ozkanaltas and thanks for sharing the above info. It seemed convenient for me to understand.
However, according to Fortinac-f documents MS-chap-v2 is mentioned like it is a standalone method:
EAP Types enabled for this server configuration. Available aoptions are:
TLS
TTLS
PEAP
MD5
GTC
MSCHAPV2
FAST
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @Akmostafa ,
Yes, you are right. This information is a little bit confusing.
Also, I found more clear information from the previous page on the document.
I think Fortinac-F resumes radius eap features from FortiNAC 9.4.
Processes RADIUS MAC and 802.1x EAP authentication without the need to proxy to an external RADIUS server. Supported 802.1x EAP modes: · TTLS/PAP · TTLS/MSCHAPv2 · PEAP/MSCHAPv2 · TLS |
https://docs.fortinet.com/document/fortinac-f/7.4.0/administration-guide/450544/virtual-servers
NSE 4-5-6-7 OT Sec - ENT FW
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That options should be for plain EAP-MSCHAPv2. As mentioned PEAP as EAP type (that stands for "PEAPv0/EAP-MSCHAPv2") is the most common used method. If you will implement it, don't forget to join FNAC to the domain as shown here.
If you have found a solution, please like and accept it to make it easily accessible for others.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Emirjon,
But this option is not supported on windows clients, I mean to use EAP-MS-CAHP-v2 without PEAP or EAP-TTLS when you configure 802.1x.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Using MSCHAPv2 without PEAP is not secure and should not be used, even if old supplicants support it. Windows supplicant and FNAC support both EAP PEAP or TTLS that can be used with user credentials.
EAP-TLS is the recommended version and as it seems will be the only protocol supported for future version of Windows 11.
If you have found a solution, please like and accept it to make it easily accessible for others.