ACS 4.0.2 Radius Authentication Setup

Question

Dear Experts,
I am having ACS 4.0.2 in my network, which I want to use for 802.1x Radius Authentication for Clients on PEAP-MSCHAPv2 methodology.
As per the documentation " EAP Authentication with RADIUS Server",  Doc ID: 44844
I have configured Network Configuration and populated AAA client IP range and Secret Key.
Question1:
Under Authenticate Using option, there are various RADIUS flavors available for selection. For a Non Cisco AAA client, should I select RADIUS IETF?
Question 2:
In the above snap shot, It has an option called Global Authentication Setup, where we can setup EAP configuration. Under PEAP subsection there is an option to "Allow EAP-MSCHAPv2" check box.
After checking that, is a restart required to the ACS Server? Would it cause any disruptions to the existing services on the ACS?
Kindly help as it is not mentioned in the documentation available with me.
Regards,
Karthik

Answer 1

Hello,
As per the ASCII and HEXA settings concern you might want to ignore those fields and leave them as they are by default.
As per the "Bad request from NAS" and "Invalid message authenticator in EAP request" it is 99% of the times a Shared Secret Mismatch.
Under the ACS Interface Configuration > Advanced Options > Is the Network Device Groups option enabled? If yes, please check the Shared Secret Key at the NDG level where the device was created. Remember the NDG Shared Secret takes precedence over the one configured on the AAA Client entry itself.
Attaching an Example:
AAA client with Shared Secret as "Cisco123":
NDG Entry (which allocates AAA clients) with Shared Secret as "cisco"
In order to check the NDG Shared Secret go to Network Configuration > Click the appropriate NDG > Scroll to the bottom and click on Edit Properties.: