• IAM
• Radius MFA using MSCHAPv2 protocol

Radius MFA using MSCHAPv2 protocol

---

This is a step by step guide to configure Radius MFA using MSCHAPv2 protocol.

Radius Server Authentication Flow

Configuration Steps

1. Add NPS as External Directory

• Go to External Directories and Click on Add Directory button
• Go to RADIUS tab
• Configure the below details to add NPS as RADIUS Server:
• Server Name - Any name for your reference.
• Server Host - Public IP address of the NPS Server.
• Server Port - The Port on which NPS listens to the RADIUS requests. (It is generally 1812)
• Shared Secret
• After configuring the given above details, Click on Save.

2. Configure RADIUS App in miniOrange

• Edit the previously created RADIUS application.
• Go to Advanced Settings.
• Select the Server Name which you chose in the previous step as the Primary Identity Provider.

3. Configure NPS Server

a. Configure New RADIUS Client

• Add a friendly name for your reference.
• Add radius.xecurify.com in the Address field.
• Type the Shared Secret which you have configured earlier in miniOrange.

b. Configure a Connection Request Policy

• Give a policy name for your reference, set Type of Network Access Server as Remote Access Server and then click on Next.



• Add condition for NAS Port Type with value as Virtual(VPN) OR Wireless - IEEE 802.11 OR Wireless - Other then click Next.



• Check Authenticate requests on this server and click Next.



• Check Override network policy authentication settings and Microsoft Encrypted Authentication version 2 (MS-CHAP-v2) as authentication method, then click Next.



• Click next on this screen without changing anything.



• Verify the settings which you have configured and then click on Finish.

c. Configure Network Policy

• Give a policy name for your reference, set Type of Network Access Server as Remote Access Server and then click on Next.



• Add condition for NAS Port Type with value as Virtual(VPN) OR Wireless - IEEE 802.11 OR Wireless - Other then click Next.



• Check Access Granted and click on Next.



• Check Microsoft Encrypted Authentication version 2 (MS-CHAP-v2) as authentication method, then click Next.



• Click next on this screen without changing anything.



• Click next on this screen without changing anything.



• Verify the settings which you have configured and then click on Finish.