We have a Cisco 3825 router with an IPSec Remote Access VPN configured to authenticate against a radius server. We're retiring the old server and moving to a new one (Windows Server 2012). We changed the radius-server host line in our config accordingly and the router is able to communicate with the new radius server. The server is denying access however, because the Cisco is configured to use PAP authentication which I've configured our radius to not accept because it is insecure. I'd like to change this to PEAP-MSCHAPv2 on the router but can't manage to figure out if this is possible. I find a lot of information about this related to the ASA, but not the IOS platform. Any advice on how to configure this?
Running C3825-ADVIPSERVICESK9-M Version 12.4(24)T8
Cleansed config pasted below:
crypto isakmp policy 10 encr aes authentication pre-share group 2 crypto isakmp key <remove> address <remove> no-xauth crypto isakmp keepalive 20 3 crypto isakmp client configuration group ABC key <remove> dns <remove> domain <remove> pool ABCpool acl 150 max-logins 10 netmask 255.255.255.0 crypto ipsec transform-set ABCtransform esp-aes esp-sha-hmac crypto ipsec df-bit clear crypto dynamic-map dynmap 10 set transform-set ABCtransform reverse-route crypto map ABCmap client authentication list ABCvpn crypto map ABCmap isakmp authorization list ABCgroups crypto map ABCmap client configuration address respond crypto map ABCmap 10 ipsec-isakmp set peer <remove> set transform-set ABCtransform match address vpn_tunnel crypto map ABCmap 1000 ipsec-isakmp dynamic dynmap interface GigabitEthernet0/1 crypto map ABCmap radius-server host <serverA> auth-port 1812 acct-port 1813 key 7 <remove> radius-server host <serverB> auth-port 1812 acct-port 1813 key 7 <remove> radius-server key 7 <remove>