AAA NPS encryption

[bob_heathote]

If I want credentials sent to a Windows NPS server to be encrypted and not in the clear text, is it just the value for "key", or do we need something else? I think we should be using TLS but I can't find more information. We are using SSH to login which is encrypted but I'm worried about the credentials sent to the NSP server. We are using ICX 7450 and 7250 switches.

[netwizz · Accepted solution]

Well, unfortunately Windows NPS supports RADIUS, so this is not really an ICX issue that can be fixed by Comscope or Ruckus but rather a protocol limitation.  In fact ANY vendor including direct competitors such as HP/ProCurve and Cisco that login to NPS use RADIUS as well and have the same weakness.  It might be better if it at least used PEAP, but I have never had that working outside of Wireless Authentication, which is another topic altogether.

If you want to do full credential encryption you might prefer TACACS+ or perhaps LDAPS /w TLS.  Regardless, you are going to need something more robust than NPS.

What comes to mind is ClearPass and the Identify Services Engine (ISE).  I am pretty sure NPS is being deprecated much like IAS was years ago.

Good luck.

[bob_heathote]

Thanks for the great reply.