1

We have a Cisco 3825 router with an IPSec Remote Access VPN configured to authenticate against a radius server. We're retiring the old server and moving to a new one (Windows Server 2012). We changed the radius-server host line in our config accordingly and the router is able to communicate with the new radius server. The server is denying access however, because the Cisco is configured to use PAP authentication which I've configured our radius to not accept because it is insecure. I'd like to change this to PEAP-MSCHAPv2 on the router but can't manage to figure out if this is possible. I find a lot of information about this related to the ASA, but not the IOS platform. Any advice on how to configure this?

Running C3825-ADVIPSERVICESK9-M Version 12.4(24)T8

Cleansed config pasted below:

crypto isakmp policy 10
 encr aes
 authentication pre-share
 group 2
crypto isakmp key <remove> address <remove> no-xauth
crypto isakmp keepalive 20 3


crypto isakmp client configuration group ABC
 key <remove>
 dns <remove>
 domain <remove>
 pool ABCpool
 acl 150
 max-logins 10
 netmask 255.255.255.0


crypto ipsec transform-set ABCtransform esp-aes esp-sha-hmac 
crypto ipsec df-bit clear


crypto dynamic-map dynmap 10
 set transform-set ABCtransform 
 reverse-route


crypto map ABCmap client authentication list ABCvpn
crypto map ABCmap isakmp authorization list ABCgroups
crypto map ABCmap client configuration address respond
crypto map ABCmap 10 ipsec-isakmp 
 set peer <remove>
 set transform-set ABCtransform 
 match address vpn_tunnel
crypto map ABCmap 1000 ipsec-isakmp dynamic dynmap 


interface GigabitEthernet0/1
crypto map ABCmap


radius-server host <serverA> auth-port 1812 acct-port 1813 key 7 <remove>
radius-server host <serverB> auth-port 1812 acct-port 1813 key 7 <remove>
radius-server key 7 <remove>
1
  • IOS doesn't appear to support anything else. PAP is only insecure if the transport is insecure. Since it's crossing an IPSec tunnel, it shouldn't be an issue. – Ricky Oct 7 '15 at 23:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.