AAA, NAC, Guest Access & BYOD

Can we do PAP and MS-CHAP authentication on ClearPass for Xirrus APs

Yes, starting from ClearPass version 6.6.3, ClearPass now has an option under NAS Vendor Settings when we choose Xirrus as the vendor called "Password Encryption" which allows us to select the options "PAP with shared secret" and also "MS-CHAP with shared secret" for PAP and MS-CHAP authentication of users respectively. 

This setting is significant because in the versions prior to 6.6.3 we could only do CHAP authentication with Xirrus APs across ClearPass with a controller initiated login.  That would not allow us to authenticate AD users as we could not perform CHAP for AD users. With the capability now added to CPPM from version 6.6.3 we can do both MS-CHAP and PAP across Xirrus APs which can be used to authenticate AD users as well as users in different authentication sources.

This option has been confirmed to be working on Xirrus AOS 8.2.4.