Change RADIUS auth method for remote access ipsec vpn

Question

We have a Cisco 3825 router with an IPSec Remote Access VPN configured to authenticate against a radius server. We're retiring the old server and moving to a new one (Windows Server 2012). We changed the radius-server host line in our config accordingly and the router is able to communicate with the new radius server. The server is denying access however, because the Cisco is configured to use PAP authentication which I've configured our radius to not accept because it is insecure. I'd like to change this to PEAP-MSCHAPv2 on the router but can't manage to figure out if this is possible. I find a lot of information about this related to the ASA, but not the IOS platform. Any advice on how to configure this?

Running C3825-ADVIPSERVICESK9-M Version 12.4(24)T8

Cleansed config pasted below:

crypto isakmp policy 10
 encr aes
 authentication pre-share
 group 2
crypto isakmp key <remove> address <remove> no-xauth
crypto isakmp keepalive 20 3


crypto isakmp client configuration group ABC
 key <remove>
 dns <remove>
 domain <remove>
 pool ABCpool
 acl 150
 max-logins 10
 netmask 255.255.255.0


crypto ipsec transform-set ABCtransform esp-aes esp-sha-hmac 
crypto ipsec df-bit clear


crypto dynamic-map dynmap 10
 set transform-set ABCtransform 
 reverse-route


crypto map ABCmap client authentication list ABCvpn
crypto map ABCmap isakmp authorization list ABCgroups
crypto map ABCmap client configuration address respond
crypto map ABCmap 10 ipsec-isakmp 
 set peer <remove>
 set transform-set ABCtransform 
 match address vpn_tunnel
crypto map ABCmap 1000 ipsec-isakmp dynamic dynmap 


interface GigabitEthernet0/1
crypto map ABCmap


radius-server host <serverA> auth-port 1812 acct-port 1813 key 7 <remove>
radius-server host <serverB> auth-port 1812 acct-port 1813 key 7 <remove>
radius-server key 7 <remove>

Answer 1

    aaa new-model
!
aaa authentication ppp default group radius
aaa authorization network default group radius 
!
aaa group server radius ABCradius
 server <serverA> auth-port 1812 acct-port 1813
 server <serverB> auth-port 1812 acct-port 1813
!
aaa authentication login ABClogin group ABCradius
aaa authorization network ABCauthorization group ABCradius 
!
crypto isakmp policy 10
 encr aes
 authentication pre-share
 group 2
crypto isakmp key <remove> address <remove> no-xauth
crypto isakmp keepalive 20 3
!
crypto ipsec transform-set ABCtransform esp-aes esp-sha-hmac 
crypto ipsec df-bit clear
!
crypto dynamic-map dynmap 10
 set transform-set ABCtransform 
 reverse-route
!
crypto map ABCmap client authentication list ABClogin
crypto map ABCmap isakmp authorization list ABCauthorization
crypto map ABCmap client configuration address respond
crypto map ABCmap 10 ipsec-isakmp 
 set peer <remove>
 set transform-set ABCtransform 
 match address vpn_tunnel
crypto map ABCmap 1000 ipsec-isakmp dynamic dynmap 
!
interface GigabitEthernet0/1
 crypto map ABCmap
!
radius-server attribute 25 access-request include 
radius-server host <serverA> auth-port 1812 acct-port 1813 key 7 <remove>
radius-server host <serverB> auth-port 1812 acct-port 1813 key 7 <remove>
!
line vty 0 4
 login authentication ABClogin
 authorization exec ABCauthorization 
!

Create a new RADIUS server group: Enable PEAP and MSCHAPv2 authentication for the new server group: Update the crypto map to use the new RADIUS server group for authentication: