Question: Our PIX-525 (v6.3.5) is currently accepting L2TP connections over IPSec. Auth is MSCHAP, crypto is 3DES/SHA.
We are starting to have users with Windows Vista. Because Vista no longer supports MSCHAPv1, and because PIX doesn't support MSCHAPv2, I must consider using a different auth method. I did not consider CHAP, because we've had too many problems with it.
I thought that using PAP would suffice since the connection is over IPSec. Does this make sense or am I opening up a huge hole here? I would NEVER consider using PAP for anything unless IPSec was configured as well. Even though PAP auth is not encrypted, it is within an IPSec tunnel, which is encrypted. What would be the best practice here?
PS - I do realize that MSCHAP doesn't set the world on fire when it comes to security either.