topic AAA NPS encryption in ICX Switches

AAA NPS encryption

bob_heathote — Thu, 08 Oct 2020 19:00:52 GMT

If I want credentials sent to a Windows NPS server to be encrypted and not in the clear text, is it just the value for "key", or do we need something else? I think we should be using TLS but I can't find more information. We are using SSH to login which is encrypted but I'm worried about the credentials sent to the NSP server. We are using ICX 7450 and 7250 switches.

Re: AAA NPS encryption

netwizz — Fri, 09 Oct 2020 04:46:20 GMT

Well, unfortunately Windows NPS supports RADIUS, so this is not really an ICX issue that can be fixed by Comscope or Ruckus but rather a protocol limitation. In fact ANY vendor including direct competitors such as HP/ProCurve and Cisco that login to NPS use RADIUS as well and have the same weakness. It might be better if it at least used PEAP, but I have never had that working outside of Wireless Authentication, which is another topic altogether.

If you want to do full credential encryption you might prefer TACACS+ or perhaps LDAPS /w TLS. Regardless, you are going to need something more robust than NPS.

What comes to mind is ClearPass and the Identify Services Engine (ISE). I am pretty sure NPS is being deprecated much like IAS was years ago.

Good luck.

Re: AAA NPS encryption

bob_heathote — Fri, 09 Oct 2020 17:47:19 GMT

Thanks for the great reply.