We recently rolled out Duo for a client who required L2TP connections to their EdgeRouter to accommodate non-PC, Mac users. To enable PAP VPN on MacOS, we had to enter the following commands to disable all other authentication methods. Note that this method only affects the user, not the entire system or other users on the same system.

nano ~/.ppprc

Paste in and save:

refuse-chap
refuse-mschap
refuse-mschap-v2

Or supply the user with these commands to copy and paste into Terminal:

echo refuse-chap > ~/.ppprc
echo refuse-mschap >> ~/.ppprc
echo refuse-mschap-v2 >> ~/.ppprc