Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
10-08-2020 12:00 PM
If I want credentials sent to a Windows NPS server to be encrypted and not in the clear text, is it just the value for "key", or do we need something else? I think we should be using TLS but I can't find more information. We are using SSH to login which is encrypted but I'm worried about the credentials sent to the NSP server. We are using ICX 7450 and 7250 switches.
Solved! Go to Solution.
1 ACCEPTED SOLUTION
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
10-08-2020 09:46 PM
Well, unfortunately Windows NPS supports RADIUS, so this is not really an ICX issue that can be fixed by Comscope or Ruckus but rather a protocol limitation. In fact ANY vendor including direct competitors such as HP/ProCurve and Cisco that login to NPS use RADIUS as well and have the same weakness. It might be better if it at least used PEAP, but I have never had that working outside of Wireless Authentication, which is another topic altogether.
If you want to do full credential encryption you might prefer TACACS+ or perhaps LDAPS /w TLS. Regardless, you are going to need something more robust than NPS.
What comes to mind is ClearPass and the Identify Services Engine (ISE). I am pretty sure NPS is being deprecated much like IAS was years ago.
Good luck.
If you want to do full credential encryption you might prefer TACACS+ or perhaps LDAPS /w TLS. Regardless, you are going to need something more robust than NPS.
What comes to mind is ClearPass and the Identify Services Engine (ISE). I am pretty sure NPS is being deprecated much like IAS was years ago.
Good luck.
2 REPLIES 2
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
10-08-2020 09:46 PM
Well, unfortunately Windows NPS supports RADIUS, so this is not really an ICX issue that can be fixed by Comscope or Ruckus but rather a protocol limitation. In fact ANY vendor including direct competitors such as HP/ProCurve and Cisco that login to NPS use RADIUS as well and have the same weakness. It might be better if it at least used PEAP, but I have never had that working outside of Wireless Authentication, which is another topic altogether.
If you want to do full credential encryption you might prefer TACACS+ or perhaps LDAPS /w TLS. Regardless, you are going to need something more robust than NPS.
What comes to mind is ClearPass and the Identify Services Engine (ISE). I am pretty sure NPS is being deprecated much like IAS was years ago.
Good luck.
If you want to do full credential encryption you might prefer TACACS+ or perhaps LDAPS /w TLS. Regardless, you are going to need something more robust than NPS.
What comes to mind is ClearPass and the Identify Services Engine (ISE). I am pretty sure NPS is being deprecated much like IAS was years ago.
Good luck.
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
10-09-2020 10:47 AM
Thanks for the great reply.

