Symptom

When a radius server is configured on ASA to use MS-CHAPv2 (mschapv2) and if the server after accepting the initial password, then provides a challenge (for example when using one time password), then ASA will fail the second authentication request with the following debug message: Invalid authenticator received. Failing authentication.

Conditions

* Radius authentication with ms-chapv2 enabled (ie. password management enabled on the tunnel-group) * Radius server sends challenge request * Radius server sends MS-CHAP2-Success attribute in final Access-Accept

Workaround

Disable ms-chapv2 on the ASA - but this will prevent radius password changes. Two options: 1) no password-mangement on the tunnel-group 2) no mschapv2-capable on the aaa-server configuration.

Further Problem Description