Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor

CHAP RADIUS authentication not working between FortiGate and NPS

Hi all,


At one of my customers I've setup FortiGate SSL VPN with MFA. For MFA we use Azure MFA together with Windows NPS:


It's a FortiGate 600E cluster, running on FortiOS 6.4.6. The NPS is a Windows Server 2019.


The setup is working fine with  when we use PAP authentication between the FortiGate and the NPS, but because this method is not secure, we want to use MS-CHAPv2 for authentication.


On the FortiGate we have specified MS-CHAP-v2 as authentication method in the RADIUS server settings. MS-CHAPv2 is also enabled on the Connection Request Policy and the Network Policy on our Windows NPS. Unfortunately, authentication is not working.


When we try to connect the SSL VPN, the FortiClient gives the following errror: credential or ssl vpn configuration is wrong (-7200). The RADIUS requests are arriving at our NPS but the NPS event logs don't give me any usefull information.


I already tried switchting between MS-CHAPv2, MS-CHAP and CHAP, but none of them are working. Authentication is only working with PAP.


Is someone familiar with this kind of setup?



Best regards,



New Contributor

Hi Jorge

I have same problem. Did you get reply to how to fix this issue ?



New Contributor

This might help

By default the RADIUS client on the FortiGate is set to auto negotiate the auth type and will try PAP, MSCHAPv2, and then CHAP in that order, and use the first one it finds (don’t ask me why it is in that order). You can either force it to only use MSCHAPv2 on the FortiGate side, or disable PAP as an auth method in the network policy on NPS and it should negotiate to something else. See auth-type options in the CLI


# set auth-type

auto          Use PAP, MSCHAP_v2, and CHAP (in that order).

ms_chap_v2    Microsoft Challenge Handshake Authentication Protocol version 2.

ms_chap       Microsoft Challenge Handshake Authentication Protocol.

chap          Challenge Handshake Authentication Protocol.

pap           Password Authentication Protocol.


This is a great reference Raymon, but it doesn't work for me, unfortunately. I configured the ms_chap_v2 via CLI, but the Event log on the RADIUS Server still getting that the authentication type is PAP.


Firewall 6.0.4
config user radius
edit "SRVRD01"
set server "192.168.x.x"
set secret "keep secret"
set auth-type ms_chap_v2
set source-ip "192.168.x.x"

MS RADIUS Event: Authentication Type: PAP



May be this can help?


If you must use MS-CHAPv2, you can enable NTLMv2 authentication by adding this registry entry:


  1. Select Start > Run, type regedit in the Open box, and then select OK.
  2. Locate and select the following registry subkey:
  3. On the Edit menu, point to New, and then select DWORD Value.
  4. Type Enable NTLMv2 Compatibility, and then press ENTER.
  5. On the Edit menu, select Modify.
  6. In the Value data box, type 1, and then select OK.
  7. Exit Registry Editor.





Sachin Gurung

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Top Kudoed Authors