Fortigate is using PAP even when MSCHAPv2 selected

[dpbriscoe]

I'm adding a second wifi SSID to our current setup.  We are using Fortigate V7.4.8 with NPS for authentication.  The first wifi SSID, which works fine, is setup to allow a domain user to connect.  I'm setting up the second as an IT wifi hotspot to allow select IT personal to join a specific VLAN for IT tasks.  Everything is setup and works great except for authentication.   Here is my setup for radius:

config user radius

edit "DC_RADIUS"
set server "X.X.X.X"
set secret ENC XXX
set nas-ip "X.X.X.X"
set source-ip "X.X.X.Y"
set secondary-server "X.X.X.Z"
set secondary-secret ENC XXX
next
edit "XXX_IT_RADIUS"
set server "X.X.X.X"
set secret ENC XXX
set nas-ip X.X.X.X
set auth-type ms_chap_v2
set source-ip "X.X.X.Y"
set secondary-server "X.X.X.Z"
set secondary-secret ENC XXX
next

end

DC_RADIUS is our radius setup for domain users and XXX_IT_RADIUS is the radius setup for our IT wifi.  The issue is that even though I'm specifying the auth-type for XXX_IT_RADIUS, Fortigate only tries to authenticate with PAP.  Here is the debug from FORTIGATE:

2025-11-04 08:53:11 [810] __rad_auth_ctx_insert-Loaded RADIUS server 'XXX_IT_RADIUS'
2025-11-04 08:53:11 [923] fnbamd_cfg_get_radius_list-Total rad servers to try: 1
2025-11-04 08:53:11 [1030] fnbamd_cfg_radius_clear_reachability-Clearing RAD server reachability XXX_IT_RADIUS:X.X.X.X
2025-11-04 08:53:11 [301] fnbamd_radius_get_next_auth_prot-Next auth prot PAP
2025-11-04 08:53:11 [1133] __rad_chk_resp_authenticator-The Message Authenticator validation is mandatory now
2025-11-04 08:53:11 [1156] __rad_chk_resp_authenticator-ret=0
2025-11-04 08:53:11 [1231] fnbamd_rad_validate_pkt-RADIUS resp code 3
2025-11-04 08:53:11 [1031] __rad_error-Ret 1, st = 1.
2025-11-04 08:53:11 [301] fnbamd_radius_get_next_auth_prot-Next auth prot ??
2025-11-04 08:53:11 [1080] __rad_error-
2025-11-04 08:53:11 [307] __rad_udp_close-closed.

I've removed a lot of lines for brevities sake but can add them back if needed.  The 301 line shows it's trying to authenticate with PAP even though I specified MSCHAPV2.  If I turn PAP on in the NPS, then it authenticates fine but I don't want to authenticate with PAP.  I've also tried pointing the IT wifi SSID to DC_RADIUS but it still authenticates only with PAP even though it works the other way with the domain wifi.  I've looked at the config for the domain SSID wifi and IT SSID wifi and they are identical.  

Oddly enough, DC_RADIUS which doesn't have an auth defined would be set to any.  From the documentation this should cycle through different auth methods starting with PAP and then moving to MSCHAPv2.  Even though DC_RADIUS is setup as any, it auths with MSCHAPV2 first (which is what I want) which succeeds and allows log in when connected to the domain wifi:

2025-11-04 08:53:17 [810] __rad_auth_ctx_insert-Loaded RADIUS server 'DC_RADIUS'
2025-11-04 08:53:17 [923] fnbamd_cfg_get_radius_list-Total rad servers to try: 1
2025-11-04 08:53:17 [301] fnbamd_radius_get_next_auth_prot-Next auth prot MS-CHAPv2
2025-11-04 08:53:17 [1133] __rad_chk_resp_authenticator-The Message Authenticator validation is mandatory now
2025-11-04 08:53:17 [1156] __rad_chk_resp_authenticator-ret=0
2025-11-04 08:53:17 [1231] fnbamd_rad_validate_pkt-RADIUS resp code 2

Also, I'm setting up the second radius auth because I need it setup to use a different remote group with the NPS.

Any help would be appreciated.

[adambomb1219]

You should not be using MS-CHAPv2 in 2025. It uses broken encryption. How are you handling EAP certificate trust?