Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Cisco ASA5505 8.2(2) Windows 2003 AD server

We want to configure our ASA ( to authenticate remote VPN users through RADIUS on the Windows AD controller (

We have the following entry on the ASA:

aaa-server SYSCON-RADIUS protocol radius
aaa-server SYSCON-RADIUS (inside) host
 key *****
 radius-common-pw *****

When I test a login using the account COMPANY\username I see the users credentials are correct in the security log, but I get the following in the windows system logs:

User COMPANY\myusername was denied access.
 Fully-Qualified-User-Name = Name
 NAS-IP-Address =
 NAS-Identifier = <not present> 
 Called-Station-Identifier = <not present> 
 Calling-Station-Identifier = <not present> 
 Client-Friendly-Name = ASA5510
 Client-IP-Address =
 NAS-Port-Type = Virtual
 NAS-Port = 7
 Proxy-Policy-Name = Use Windows authentication for all users
 Authentication-Provider = Windows 
 Authentication-Server = <undetermined> 
 Policy-Name = VPN Authentication
 Authentication-Type = PAP
 EAP-Type = <undetermined> 
 Reason-Code = 66
 Reason = The user attempted to use an authentication method that is not enabled on the matching remote access policy.

My assumption is that the ASA is using PAP authentication, instead of MS-CHAP v2; the credentials are confirmed, the proper Remote Access Policy is being used, but this policy is set to only allow MS-CHAP2. What do we need to do on the ASA to make it us MS-CHAP v2? In the ADSM GUI The "Microsoft CHAP v2 compatible" tickbox is enabled, but I don't know what this corresponds to in the config.

[update] I tried to add the following to the tunnel-group:

tunnel-group MYTUNNEL-AD ppp-attributes
 no authentication pap
 no authentication chap
 no authentication ms-chap-v1
 authentication ms-chap-v2

but the "no authentication pap" command doesn't do anything, and doesn't show when I run show tunnel-group... and the ASA is still using PAP.

share|improve this question
up vote 2 down vote accepted

It ultimately turned out that the test login function ignores the directive to use MSCHAP2, and will always use PAP. Testing in actual production works correctly, even though the tests will always fail.

share|improve this answer

Try enabling password management on the tunnel group by typing "password-management" while configuring tunnel group ipsec-attributes.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.