topic Re: Does EXOS (30.6) really support CHAP authentication instead of PAP. in ExtremeSwitching (EXOS/Switch Engine)

Does EXOS (30.6) really support CHAP authentication instead of PAP.

raphaelp — Mon, 21 Feb 2022 19:09:46 GMT

Hi,

First of all, my lab environnement has been made made with:
-a X460G2-48t-10G4 in EXOS 30.6.1.11 patch 11 version.
-a windows NPS server.

I tried unsuccessfully to configure radius authentication using CHAP .
It works with PAP protocole but security team want to improve the authentication using CHAP.

My network traces prooves that there is only PAP requests.

Packets requests contains attribute #2 "user-password" and no "CHAP-PASSWORD" attribute #3.

In "user guide" and "command reference" , i haven't found the clue!
(There is no "chap" command in 'configure radius" menu... )

Even if the "user guide" mentions it:
Page 1045 : "The RADIUS client software sends authentication requests using standard mechanisms for PAP, CHAP
(RFC 2865 (13)) and EAP (RFC 3579 (12))."

Is it really possible to force the use of CHAP instead of PAP with radius authentication mode?
(in 30.6 version or upper version)

Best regards

Raphaël

Re: Does EXOS (30.6) really support CHAP authentication instead of PAP.

Gabriel_G — Wed, 02 Mar 2022 00:46:16 GMT

Hi Raphaël,

I believe EXOS currently only supports PAP for MAC based and management access authentication and there is no configuration to change that behavior. However, I know other customers have requested CHAP support so I'd recommend creating a feature request with your account team to push for that feature.

Hope that helps!

Re: Does EXOS (30.6) really support CHAP authentication instead of PAP.

raphaelp — Wed, 02 Mar 2022 00:46:36 GMT

Gabriel,

Finally, I had and answer from our Extreme support and they said the same : CHAP is not supported yet and they suggested to make feature request!

Thank you