CAS-003 · Question #677
A company uses AD and RADIUS to authenticate VPN and WiFi connections. The Chief Information Security Officer (CISO) initiates a project to extend a third-party MFA solution to VPN. During the pilot…
The correct answer is A. In the RADIUS server, the proxy rule has not specified the NAS-Port-Type attribute that should be. The RADIUS proxy rule must filter on the NAS-Port-Type attribute to distinguish VPN from WiFi authentication requests so that only VPN traffic is forwarded to the MFA solution.
Question
A company uses AD and RADIUS to authenticate VPN and WiFi connections. The Chief Information Security Officer (CISO) initiates a project to extend a third-party MFA solution to VPN. During the pilot phase, VPN users successfully get an MFA challenge, however they also get the challenge when connecting to WiFi which is not desirable. Which of the following BEST explains why users are getting the MFA challenge when using WiFi?
Options
- AIn the RADIUS server, the proxy rule has not specified the NAS-Port-Type attribute that should be
- BIn the firewall, in the AAA configuration the IP address of the third-party MFA solution needs to be
- CIn the third-party MFA solution authentication properties need to be configured to recognize WiFi
- DIn the WiFi configuration authentication needs to be changed to WPA2 Enterprise using EAP-TLS
How the community answered
(19 responses)- A58% (11)
- B5% (1)
- C26% (5)
- D11% (2)
Why each option
The RADIUS proxy rule must filter on the NAS-Port-Type attribute to distinguish VPN from WiFi authentication requests so that only VPN traffic is forwarded to the MFA solution.
The NAS-Port-Type RADIUS attribute identifies the physical or virtual port type used for a connection, such as Virtual (VPN) versus Wireless-IEEE-802.11 (WiFi). Without this condition in the proxy policy, the RADIUS server forwards all authentication requests to the third-party MFA solution regardless of connection type. Adding the correct NAS-Port-Type match to the proxy rule ensures WiFi requests are handled locally by AD/RADIUS without invoking MFA.
The firewall AAA configuration governs access to the RADIUS server itself, not the internal proxy logic that routes authentication requests to different backends based on connection type.
Configuring the MFA solution to recognize WiFi would still allow WiFi requests to reach the MFA system rather than preventing them from being proxied in the first place.
Switching WiFi to WPA2 Enterprise with EAP-TLS changes the authentication method to certificate-based but does not modify the RADIUS proxy routing logic that triggers MFA challenges.
Concept tested: RADIUS proxy policy filtering using NAS-Port-Type attribute
Source: https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-top
Topics
Community Discussion
No community discussion yet for this question.