topic I can't try to auth using chap for Test AAA server on Smartzone. in SmartZone and Virtual SmartZone

I can't try to auth using chap for Test AAA server on Smartzone.

Jeronimo — Tue, 06 Dec 2022 02:44:09 GMT

Hi.

I tried to auth using chap method for Test aaa server on SZ.

But SZ used only pap mothod for Test aaa server.

Doesn't this test mothod apply yet on SZ?

Regards.

Re: I can't try to auth using chap for Test AAA server on Smartzone.

bruno_andrade — Mon, 12 Dec 2022 14:02:23 GMT

Hello Jeronimo.

You can run Chap or Pap to test AAA on SZ.

Services & profiles -> Authentication -> Proxy (SZ authentication)

Select the AAA server and then click in 'Test AAA', it will open a window where you can select Pap or Chap.

If you are not seeing this option, please share the version and model of your SZ.

Re: I can't try to auth using chap for Test AAA server on Smartzone.

Jeronimo — Fri, 16 Dec 2022 07:10:49 GMT

Hi,Bruno.

I also know I can select PAP or ChAP in TEST AAA.

But wherever I tried PAP or CHAP, SZ did auth using only PAP.

I confirmed SZ is trying only PAP via wireshark on server side.

Did you test about it?

Re: I can't try to auth using chap for Test AAA server on Smartzone.

bruno_andrade — Fri, 16 Dec 2022 17:22:07 GMT

Hi Jeronimo,

Can you please tell me the model and version of your SZ?

Re: I can't try to auth using chap for Test AAA server on Smartzone.

Jeronimo — Mon, 19 Dec 2022 00:32:34 GMT

Hi Bruno.

The version which I tried is 6.1.0.0.935 with vSZ-E.

Re: I can't try to auth using chap for Test AAA server on Smartzone.

Parik_MN — Mon, 19 Dec 2022 08:26:07 GMT

Hello @Jeronimo,

I you would like to enable CHAP Test AAA. You need enable reversible encryption password in AD server. Please review below Document for more info on the same.
Ruckus has nothing to do with the encryption method, we can only choose the Authentication Protocol type in configuration.

https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption

Regards,

Parik

Re: I can't try to auth using chap for Test AAA server on Smartzone.

Jeronimo — Mon, 19 Dec 2022 09:34:38 GMT

Thanks for your mention.

B utA main point of this oservtion is vsz don't try chap method though i choose chap.

The ariticle is not related this symptom.

I have confirmed this symptom via free-radius and windows nps both.

When i tried to auth pa and chap using other supplicant not vSZ, i had confirmed chap or pap was shooted.

Has Anyone tested it?

Re: I can't try to auth using chap for Test AAA server on Smartzone.

Parik_MN — Mon, 19 Dec 2022 09:40:32 GMT

Hi @Jeronimo,

The symptoms you mentioned is usual. The settings in AAA profile is just for Testing the user credentials using PAP or CHAP. That doesn't mean we could use the same method in Dot1x authentication. For wireless client authentication the protocol used is client perspective and much more secure than just PAP/CHAP. They could use one of these, EAP/PEAP, EAP/MSCHAP-V2, EAP/TLS.

Regards,

Parik

Re: I can't try to auth using chap for Test AAA server on Smartzone.

Jeronimo — Mon, 19 Dec 2022 09:55:14 GMT

Hi parik.

As your mention, if this symptom is usual, rukcus has to remove chap method on aaa test window.

Main goal of Test aaa tool is simple checking whether the id/pass was registered or active via pap or chap.

The reason of removing this is someone who want to check via pap or chap method feels very confusing.

Why does chap method exist on aaa test window?

Re: I can't try to auth using chap for Test AAA server on Smartzone.

Parik_MN — Mon, 19 Dec 2022 14:24:27 GMT

Hello @Jeronimo,

There is a reason behind this option. Some customers prefer to Test the credentials in secure way. They could opt for CHAP, which uses reversible encryption method and pretty challenging to decrypt.

Regards,

Parik

Re: I can't try to auth using chap for Test AAA server on Smartzone.

Jeronimo — Tue, 20 Dec 2022 00:30:55 GMT

Hi Parik.

I'm sorry Your mention doesn't help for me.

What I want to say is why SZ only proceeds with pap when I test by selecting chap in the Test AAA server.

It's not related 802.1x authenticaion but chap method on Test aaa server.

I try to auth by selecting PAP it works normally.

And Please test it yourself.

Regards.

Re: I can't try to auth using chap for Test AAA server on Smartzone.

Parik_MN — Wed, 20 Dec 2023 16:34:44 GMT

Hello @Jeronimo,

If you are still reporting this issue, please try testing with new firmware 6.1.2. If the issue persists, please feel free to open a support case for further assistance.

Regards,

Parik

Re: I can't try to auth using chap for Test AAA server on Smartzone.

Jeronimo — Tue, 20 Aug 2024 23:58:47 GMT

I tested it recently, and it was possible to test with chap in versions sz 6.1.2 and 7.0.0.

It was not possible with chap for a long time, but it was recently patched.