About Supported EAP methods in Fortinac

[Akmostafa]

Hello team.

As far as I understand in 802.1x authentication there are two mechanism evolved to authenticate supplicant. The outer method than encapsulates and secure the eap messages (like PEAP and TTLS) and inner methods (like PAP and CHAP and ms-chap-v2).

I can see that PEAP can be used along with mschapv2 and this is clear when I configure the supplicant.

However, I am not sure what mschapv2 means when it is listed among other methods in Fortinac RADiUS configuration as outer method. And can mschapv2 used alone in 802.1x and how can I configure the supplicant correctly to use it.

[ozkanaltas]

Hello @Akmostafa ,

You can find supported methods on Fortinac below. For mschapv2 you can select both outer methods. In my experience generally, everyone uses peap/mschapv2. 

• Supported 802.1x EAP methods:
  • TTLS/PAP: Handles authentication requests through
    • LDAP servers defined in FortiNAC
    • RADIUS servers defined in FortiNAC
    • Local Users (including guests) in the FortiNAC database
  • TTLS/MSCHAPv2: Authenticates AD Users only
    • FortiNAC must join the domain
    • Limited to one domain
  • PEAP/MSCHAPv2: Authenticates AD Users only
    • FortiNAC must join the domain
    • Limited to one domain
  • TLS: Authenticates UserPrincipalName SAN User from the certificate
    • Requires the Endpoint Trust Certificate to be installed so FortiNAC can validate the client-side certificate. For installation instructions see Certificate management.
  • FAST: Flexible Authentication via Secure Tunneling
    • PAC Opaque Key
    • Allow Anonymous In-Band PAC Provisioning
    • Allow Authenticated In-Band PAC Provisioning

https://docs.fortinet.com/document/fortinac/9.4.0/administration-guide/450544/local-radius-server

[Akmostafa]

Hi Ozkanaltas and thanks for sharing the above info. It seemed convenient for me to understand.

However, according to Fortinac-f documents MS-chap-v2  is mentioned like it is a standalone method:

EAP Types enabled for this server configuration. Available aoptions are:

TLS

TTLS

PEAP

MD5

GTC

MSCHAPV2

FAST

https://docs.fortinet.com/document/fortinac-f/7.4.0/administration-guide/463215/configure-local-serv...

[ozkanaltas]

Hi @Akmostafa ,

Yes, you are right. This information is a little bit confusing.

Also, I found more clear information from the previous page on the document.

I think Fortinac-F resumes radius eap features from FortiNAC 9.4.

Processes RADIUS MAC and 802.1x EAP authentication without the need to proxy to an external RADIUS server.

Supported 802.1x EAP modes:

· TTLS/PAP

· TTLS/MSCHAPv2

· PEAP/MSCHAPv2

· TLS

https://docs.fortinet.com/document/fortinac-f/7.4.0/administration-guide/450544/virtual-servers

[ebilcari]

That options should be for plain EAP-MSCHAPv2. As mentioned PEAP as EAP type (that stands for "PEAPv0/EAP-MSCHAPv2") is the most common used method. If you will implement it, don't forget to join FNAC to the domain as shown here.

[Akmostafa]

Hi Emirjon,

But this option is not supported on windows clients, I mean to use EAP-MS-CAHP-v2 without PEAP or EAP-TTLS when you configure 802.1x.

[ebilcari · Accepted solution]

Using MSCHAPv2 without PEAP is not secure and should not be used, even if old supplicants support it. Windows supplicant and FNAC support both EAP PEAP or TTLS that can be used with user credentials.

EAP-TLS is the recommended version and as it seems will be the only protocol supported for future version of Windows 11.