CHAP RADIUS authentication not working between FortiGate and NPS

[Jorg_SVC]

Hi all,

At one of my customers I've setup FortiGate SSL VPN with MFA. For MFA we use Azure MFA together with Windows NPS: https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension

It's a FortiGate 600E cluster, running on FortiOS 6.4.6. The NPS is a Windows Server 2019.

The setup is working fine with  when we use PAP authentication between the FortiGate and the NPS, but because this method is not secure, we want to use MS-CHAPv2 for authentication.

On the FortiGate we have specified MS-CHAP-v2 as authentication method in the RADIUS server settings. MS-CHAPv2 is also enabled on the Connection Request Policy and the Network Policy on our Windows NPS. Unfortunately, authentication is not working.

When we try to connect the SSL VPN, the FortiClient gives the following errror: credential or ssl vpn configuration is wrong (-7200). The RADIUS requests are arriving at our NPS but the NPS event logs don't give me any usefull information.

I already tried switchting between MS-CHAPv2, MS-CHAP and CHAP, but none of them are working. Authentication is only working with PAP.

Is someone familiar with this kind of setup?

Thanks!

Best regards,

Jorg

[raymond_maharaj]

Hi Jorge

I have same problem. Did you get reply to how to fix this issue ?

Thanks 

[raymond_maharaj]

This might help

By default the RADIUS client on the FortiGate is set to auto negotiate the auth type and will try PAP, MSCHAPv2, and then CHAP in that order, and use the first one it finds (don’t ask me why it is in that order). You can either force it to only use MSCHAPv2 on the FortiGate side, or disable PAP as an auth method in the network policy on NPS and it should negotiate to something else. See auth-type options in the CLI https://docs.fortinet.com/document/fortigate/7.0.1/cli-reference/496620/config-user-radius

# set auth-type

auto          Use PAP, MSCHAP_v2, and CHAP (in that order).

ms_chap_v2    Microsoft Challenge Handshake Authentication Protocol version 2.

ms_chap       Microsoft Challenge Handshake Authentication Protocol.

chap          Challenge Handshake Authentication Protocol.

pap           Password Authentication Protocol.

[MP_Bover]

This is a great reference Raymon, but it doesn't work for me, unfortunately. I configured the ms_chap_v2 via CLI, but the Event log on the RADIUS Server still getting that the authentication type is PAP.

Firewall 6.0.4
config user radius
edit "SRVRD01"
set server "192.168.x.x"
set secret "keep secret"
set auth-type ms_chap_v2
set source-ip "192.168.x.x"
next

MS RADIUS Event: Authentication Type: PAP

[sgurung]

May be this can help?

If you must use MS-CHAPv2, you can enable NTLMv2 authentication by adding this registry entry:

1. Select Start > Run, type regedit in the Open box, and then select OK.
2. Locate and select the following registry subkey:
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\RemoteAccess\Policy
3. On the Edit menu, point to New, and then select DWORD Value.
4. Type Enable NTLMv2 Compatibility, and then press ENTER.
5. On the Edit menu, select Modify.
6. In the Value data box, type 1, and then select OK.
7. Exit Registry Editor.

Reference, https://docs.microsoft.com/en-gb/troubleshoot/windows-server/networking/rras-vpn-connections-fail-ms...

Thanks,

SG