Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Akmostafa
New Contributor III

About Supported EAP methods in Fortinac

Hello team.

As far as I understand in 802.1x authentication there are two mechanism evolved to authenticate supplicant. The outer method than encapsulates and secure the eap messages (like PEAP and TTLS) and inner methods (like PAP and CHAP and ms-chap-v2).

 

I can see that PEAP can be used along with mschapv2 and this is clear when I configure the supplicant.

 

However, I am not sure what mschapv2 means when it is listed among other methods in Fortinac RADiUS configuration as outer method. And can mschapv2 used alone in 802.1x and how can I configure the supplicant correctly to use it.

1 Solution
ebilcari

Using MSCHAPv2 without PEAP is not secure and should not be used, even if old supplicants support it. Windows supplicant and FNAC support both EAP PEAP or TTLS that can be used with user credentials.

EAP-TLS is the recommended version and as it seems will be the only protocol supported for future version of Windows 11.

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.

View solution in original post

6 REPLIES 6
ozkanaltas
Valued Contributor III

Hello @Akmostafa ,

 

You can find supported methods on Fortinac below. For mschapv2 you can select both outer methods. In my experience generally, everyone uses peap/mschapv2. 

 

  • Supported 802.1x EAP methods:
    • TTLS/PAP: Handles authentication requests through
      • LDAP servers defined in FortiNAC
      • RADIUS servers defined in FortiNAC
      • Local Users (including guests) in the FortiNAC database
    • TTLS/MSCHAPv2: Authenticates AD Users only
      • FortiNAC must join the domain
      • Limited to one domain
    • PEAP/MSCHAPv2: Authenticates AD Users only
      • FortiNAC must join the domain
      • Limited to one domain
    • TLS: Authenticates UserPrincipalName SAN User from the certificate
      • Requires the Endpoint Trust Certificate to be installed so FortiNAC can validate the client-side certificate. For installation instructions see Certificate management.
    • FAST: Flexible Authentication via Secure Tunneling
      • PAC Opaque Key
      • Allow Anonymous In-Band PAC Provisioning
      • Allow Authenticated In-Band PAC Provisioning

https://docs.fortinet.com/document/fortinac/9.4.0/administration-guide/450544/local-radius-server

 

 

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
Akmostafa
New Contributor III

Hi Ozkanaltas and thanks for sharing the above info. It seemed convenient for me to understand.

 

However, according to Fortinac-f documents MS-chap-v2  is mentioned like it is a standalone method:

 

EAP Types enabled for this server configuration. Available aoptions are:

TLS

TTLS

PEAP

MD5

GTC

MSCHAPV2

FAST

 

https://docs.fortinet.com/document/fortinac-f/7.4.0/administration-guide/463215/configure-local-serv...

 

ozkanaltas
Valued Contributor III

Hi @Akmostafa ,

 

Yes, you are right. This information is a little bit confusing.

 

Also, I found more clear information from the previous page on the document.

 

I think Fortinac-F resumes radius eap features from FortiNAC 9.4.

 

Processes RADIUS MAC and 802.1x EAP authentication without the need to proxy to an external RADIUS server.

Supported 802.1x EAP modes:

· TTLS/PAP

· TTLS/MSCHAPv2

· PEAP/MSCHAPv2

· TLS

 

 

https://docs.fortinet.com/document/fortinac-f/7.4.0/administration-guide/450544/virtual-servers

 

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
ebilcari

That options should be for plain EAP-MSCHAPv2. As mentioned PEAP as EAP type (that stands for "PEAPv0/EAP-MSCHAPv2") is the most common used method. If you will implement it, don't forget to join FNAC to the domain as shown here.

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.
Akmostafa
New Contributor III

Hi Emirjon,

But this option is not supported on windows clients, I mean to use EAP-MS-CAHP-v2 without PEAP or EAP-TTLS when you configure 802.1x.

ebilcari

Using MSCHAPv2 without PEAP is not secure and should not be used, even if old supplicants support it. Windows supplicant and FNAC support both EAP PEAP or TTLS that can be used with user credentials.

EAP-TLS is the recommended version and as it seems will be the only protocol supported for future version of Windows 11.

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors