In my event log, when my router tries to use Radius to authetnicate I get the following:
"""The user could not be authenticated using Challenge Handshake Authentication Protocol (CHAP). A reversibly encrypted password does not exist for this user account. To ensure that reversibly encrypted passwords are enabled, check either the domain password policy or the password settings on the user account. """
However, I enabled that for the account I am using in the User's Properties in AD. Is there some other place this needs to be enabled, or maybe I have to wait for it to replicate or restart a service (Other than the Radius one)? The IAS server is the same machine as a domain controller, and I made the change on that machine, so I would think it would take effect right away.
Also, just how unsafe is it to "reversibly encrypted passwords" ?
I should also probably say why I am doing this in case there is a better way. I am setting up a Cisco router to by an endpoint for Client-Initiated L2TP/IPSec tunnels. I want to authenticate against AD, so if there is a better way to handle the authentication please do let me know :-) Ideally, I could still use the built-in Windows VPN Client.