Hello team.
As far as I understand in 802.1x authentication there are two mechanism evolved to authenticate supplicant. The outer method than encapsulates and secure the eap messages (like PEAP and TTLS) and inner methods (like PAP and CHAP and ms-chap-v2).
I can see that PEAP can be used along with mschapv2 and this is clear when I configure the supplicant.
However, I am not sure what mschapv2 means when it is listed among other methods in Fortinac RADiUS configuration as outer method. And can mschapv2 used alone in 802.1x and how can I configure the supplicant correctly to use it.
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Using MSCHAPv2 without PEAP is not secure and should not be used, even if old supplicants support it. Windows supplicant and FNAC support both EAP PEAP or TTLS that can be used with user credentials.
EAP-TLS is the recommended version and as it seems will be the only protocol supported for future version of Windows 11.
Hello @Akmostafa ,
You can find supported methods on Fortinac below. For mschapv2 you can select both outer methods. In my experience generally, everyone uses peap/mschapv2.
https://docs.fortinet.com/document/fortinac/9.4.0/administration-guide/450544/local-radius-server
Hi Ozkanaltas and thanks for sharing the above info. It seemed convenient for me to understand.
However, according to Fortinac-f documents MS-chap-v2 is mentioned like it is a standalone method:
EAP Types enabled for this server configuration. Available aoptions are:
TLS
TTLS
PEAP
MD5
GTC
MSCHAPV2
FAST
Hi @Akmostafa ,
Yes, you are right. This information is a little bit confusing.
Also, I found more clear information from the previous page on the document.
I think Fortinac-F resumes radius eap features from FortiNAC 9.4.
Processes RADIUS MAC and 802.1x EAP authentication without the need to proxy to an external RADIUS server. Supported 802.1x EAP modes: · TTLS/PAP · TTLS/MSCHAPv2 · PEAP/MSCHAPv2 · TLS |
https://docs.fortinet.com/document/fortinac-f/7.4.0/administration-guide/450544/virtual-servers
That options should be for plain EAP-MSCHAPv2. As mentioned PEAP as EAP type (that stands for "PEAPv0/EAP-MSCHAPv2") is the most common used method. If you will implement it, don't forget to join FNAC to the domain as shown here.
Hi Emirjon,
But this option is not supported on windows clients, I mean to use EAP-MS-CAHP-v2 without PEAP or EAP-TTLS when you configure 802.1x.
Using MSCHAPv2 without PEAP is not secure and should not be used, even if old supplicants support it. Windows supplicant and FNAC support both EAP PEAP or TTLS that can be used with user credentials.
EAP-TLS is the recommended version and as it seems will be the only protocol supported for future version of Windows 11.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1688 | |
1087 | |
752 | |
446 | |
227 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.