I am trying to setup a Cisco ASA (version 9.1(7)6) to authenticate against a Microsoft Network Policy Server 2012 R2.

The ASA is able to communicate with the NPS server, however the test aaa-server command returns AAA Failure. Checking the security event log on the NPS server shows that authentication is failing because The user attempted to use an authentication method that is not enabled in the matching network policy. and Authentication Type: PAP.

What I dont understand is that Unencrypted authentication (PAP, SPAP) is enabled for the network policy. The server is on a fresh install of Windows and there is only a single network policy outside of the defaults. The event log entry does show it is matching my single (non-default) network policy. There do not appear to be any other relevant event log entires.

There only seems to be a problem with PAP authentication, as I am able to login via my VPN connection by authenticating against the NPS by using MSCHAPv2. As a note, the test aaa-server command only supports PAP authentication.

Network Policy Authentication Methods

Event Log Entry


In NPS, make sure PAP is enabled on the Connection Request Policy in addition to the Network Policy. I had a similar problem authenticating Cisco Prime Infrastructure using PAP, so maybe my solution will be applicable to you as well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.