I am trying to setup a Cisco ASA (version 9.1(7)6) to authenticate against a Microsoft Network Policy Server 2012 R2.
The ASA is able to communicate with the NPS server, however the
test aaa-server command returns AAA Failure. Checking the security event log on the NPS server shows that authentication is failing because
The user attempted to use an authentication method that is not enabled in the matching network policy. and
Authentication Type: PAP.
What I dont understand is that
Unencrypted authentication (PAP, SPAP) is enabled for the network policy. The server is on a fresh install of Windows and there is only a single network policy outside of the defaults. The event log entry does show it is matching my single (non-default) network policy. There do not appear to be any other relevant event log entires.
There only seems to be a problem with PAP authentication, as I am able to login via my VPN connection by authenticating against the NPS by using MSCHAPv2. As a note, the
test aaa-server command only supports PAP authentication.