Extensible Authentication Protocol (EAP) Support for RADIUS

Add a Certificate Profile to allow the RADIUS server to authenticate with the firewall.
Install the Server Certificate and Key on the RADIUS server.
Add the hostname or IP address of the firewall as the RADIUS client.
Upload the Root-CA and Intermediate CA certificates used to sign the RADIUS server certificate on the firewall.
Create a RADIUS server profile that uses an EAP
Authentication Protocol
:
PEAP-MSCHAPv2

(Default)

—Protected EAP (PEAP) with Microsoft Challenge-Handshake Authentication Protocol (MSCHAPv2) provides improved security over PAP or CHAP by transmitting both the username and password in an encrypted tunnel. In addition, if you are using GlobalProtect, you can allow GlobalProtect users to change expired passwords.

PEAP with GTC

—Select Protected EAP (PEAPv0) with Generic Token Card (GTC) to use one-time tokens in an encrypted tunnel.

EAP-TTLS with PAP

—Select EAP with Tunneled Transport Layer Security and PAP to transport plaintext credentials for PAP in an encrypted tunnel.


The
Auto
option is no longer supported. For more information on changes to default behavior for this feature, see Changes to Default Behavior and Upgrade/Downgrade Considerations in the Release Notes.
(Optional)
Select whether GlobalProtect users can change expired passwords:
Allow users to change passwords after expiry
(PEAP-MSCHAPv2 with GlobalProtect only)
—Select this option to allow GlobalProtect users to change expired passwords.
This feature is only supported with GlobalProtect client 4.1 or later.
Select whether the user’s identity is anonymous in the outer tunnel that the firewall creates to authenticate with the server:
Make Outer Identity Anonymous

—This option is enabled by default to anonymize the user’s identity in the outer tunnel, which is created after authenticating with the server.

You must configure the RADIUS server to allow access for anonymous users. Some RADIUS server configurations may not support anonymous outer IDs, and you may need to clear the option. When cleared, usernames are transmitted using cleartext.


Select the
Certificate Profile
that the server uses to authenticate the firewall.
Add
each RADIUS server.
Select
Device
Authentication Profile
,
Add
a profile, and assign the RADIUS server profile to the authentication profile.
To enable administrator access, select
Device
Setup
Management
, and select the Authentication Profile. Configure an Admin Role profile if the administrator uses a custom role and configure an access domain if the firewall has more than one virtual system.
If you are using GlobalProtect, see Enable Authentication Using an Authentication Profile.
If you are using Captive Portal, see Map IP Addresses to Usernames Using Captive Portal.
Commit
your changes to activate them on the firewall.
To confirm the authentication is successful, use the
test authentication authentication-profile
<auth-profile-name>
username
<username>
password
command. You can also use the
Description
column in
Monitor
Authentication
to view the EAP outer and inner identities. To troubleshoot, use
grep
to search the logs for the number in the
Authentication ID
column. For more information, refer to the PAN-OS Admin Guide.