Adding Two-Factor Authentication to Your VPN with RADIUS MFA

A corporate VPN is the door from outside into your internal network — and in most organisations the key to that door is still a single password. One username and password pair, obtained through a phishing email or another breach, puts an attacker straight inside. However strict the password policy, the structure depends on one thing.

A second factor removes that single point: knowing the password is not enough, you also have to hold something the user has — the code sent to their phone, or the one in their authenticator app.

Why go through RADIUS

VPN appliances usually do not verify credentials themselves; they ask an external source. That source can be a local user list, LDAP or RADIUS. What RADIUS offers here is the ability to insert a step into the middle of the verification.

The flow becomes: the user enters their username and password in the VPN client; the VPN asks the RADIUS server; the server verifies the password, then asks for the second factor, and only returns accept to the VPN once that is verified too. The only thing that changes on the VPN side is the authentication target.

SMS OTP or TOTP?

One-time code over SMS

A short code arrives on the user's phone. This is the easiest to roll out: nothing is required of the user beyond a correct phone number, which makes it practical for large, non-technical groups.

It has limits. It is exposed to SIM-swap attacks and to network delays, it does not work where there is no coverage, and every verification costs an SMS.

TOTP (authenticator app)

The user scans a QR code to add the account to Google Authenticator, Microsoft Authenticator or similar. The app produces a new code every 30 seconds. Because the code is computed on the phone, no network is needed, there is no per-use cost, and SIM-swap attacks do not apply.

The trade-off is a one-off enrolment step: the user has to scan that QR code, and the enrolment has to be redone when they change phones.

Protecting the verification traffic: RadSec

Classic RADIUS runs over UDP and does not encrypt the whole packet — only the password field is protected, using a scheme derived from the shared secret. That was designed for a server and a VPN sitting on the same trusted network.

If the verification request crosses the internet, RadSec is the right choice: it carries RADIUS inside TLS over TCP port 2083. Everything, usernames and requests and responses included, is encrypted.

Fail-closed: what happens when it cannot be reached

The most consequential design decision in an MFA setup is what happens when the verification server is unreachable. There are two options and the gap between them is wide:

• Fail-open: access is allowed when the server cannot be reached. Continuity is preserved, but the way to disable MFA becomes "stop the server from being reachable". The control turns into a control that can be switched off.
• Fail-closed: no verification response means access is denied. The user cannot connect, but no gap opens.

For a door that faces outward, fail-closed is the right default. It comes with an operational requirement: decide in advance how administrators will reach the network in the scenario where the server is unreachable.

Rollout order

1. Define your VPN gateway. Choose RadSec (TLS) or UDP as the transport; RadSec is the recommendation when verification crosses the internet.
2. Enrol the users. Those on TOTP receive an enrolment invitation and complete it themselves by scanning the QR code.
3. Point the VPN at RADIUS. For FortiGate SSL-VPN there is a ready CLI command card; on other appliances you enter the RADIUS server address, port and shared secret.
4. Enable it for one group first. Making MFA mandatory for every VPN user at once means nobody connects if a single setting is wrong. Go in stages.

With Captivo VPN & RADIUS MFA

Captivo's VPN & RADIUS MFA module ships this flow: SMS OTP and TOTP are both supported, the transport can be RadSec or UDP, there is a ready command card for FortiGate SSL-VPN, and the system is fail-closed. Your VPN stays on your own network; the only thing that leaves is the verification request.

This module is offered on the cloud deployment only. For the internal side of network access — wired and wireless port security — see 802.1X network access control, and for VPN-free third-party access see Captivo Access.