Description

MSCHAP not working for XAUTH in dynamic VPN

Symptoms

RADIUS server options have been set to use MSCHAPv2 when sending authentication requests, but SRX still sends authentication request using PAP despite configuration settings:

show access
profile radius-server {
       authentication-order radius;
                 radius-server {
                            192.168.2.1 {
                                       secret "$ABC123"; ## SECRET-DATA
                                       source-address 10.100.2.253;
                                                   }
                                           }
                                      }

show system
radius-options {
                 password-protocol mschap-v2;
                 attributes {
                          nas-ip-address192.168.2.253;
                                    }
                            }

Solution

MSCHAP is currently not supported for xauth for DVPN.
NOTE: The SRX does not transmit user passwords in clear text to the RADIUS server even when using PAP protocol. The shared secret is used along with MD5 hashing algorithm to obfuscate user passwords.