u/PsychologicalNet3634

TLDR: I need to configure a Cisco Firewall running FTD (not FMC) to authenticate admin logins using MSCHAPv2. Security is the objective here. I have Windows NPS running and AD running on another VM. I can get the Firewall to authenticate with CHAP/PAP, but not MSCHAPv2.

I know there are a lot of variables and I feel like an actual guide (not AI...it hasn't worked out well so far lol) would be most beneficial here, but open to any help or advice anyone wants to give.

I can ping both AD and NPS servers and traffic will pass on the 389 and 636 ports. I sniffed the traffic and can see the handshake, but the it appears AD is killing the session. I am having a hard time finding the actual error response on AD (I don't manage it, but know the admin) and would think that it would tell me exactly why it's not working.

I know it's vague, but any tutorials on setting up any of the above would be absolutely most appreciative.

TIA

I'm using FTD to configure an AD Realm on a 3105 firewall. I got it working a while back, but have to reconfigure due to replacing equipment. All examples are fictitious but the format is accurate and I have triple checked that I am using the correct identifiers. I gave it a name, username (username@domain), password, Base DN (DC=TD,DC=A), AD Primary Domain, Hostname, Interface (there's only one) and encryption set to non. I tried LDAPS and added a cert and it didn't work either. I can see the traffic hitting the DC, connection is established, then dropped. I even had the DC Admin looking at it and he said all the info I was adding to the Realm was accurate.

So what am I doing wrong? Is this an order of operations problem? Like maybe I should be adding the Radius server config first (I did that and they test good)? I am pulling my hair out.

Thanks in advance.