topic Re: Change VPN client authentication option in General Topics

Change VPN client authentication option

Ruan_Kotze — Fri, 14 Mar 2025 12:06:46 GMT

Hi CheckMates,

We are transitioning our VPN to authentication via Entra, primarily to enforce MFA.

My question relates to migrating the client settings. Is there a way to accomplish this by manipulating the Authentication settings on the gateway? What I have done is made the MFA option the first priority in the Multiple Authentication Options list.

On the client side this results in the MFA option being labelled as the default, but it seems that regardless of that the client just uses the last succesful authentication method.

Is there anything we can do to flip the clients over to the MFA login option without needing to touch the client?

Thanks,
Ruan

Re: Change VPN client authentication option

PhoneBoy — Mon, 17 Mar 2025 18:40:26 GMT

You're using SAML, correct?
As I recall, this requires deleting and re-adding the site.

Re: Change VPN client authentication option

the_rock — Mon, 17 Mar 2025 22:31:17 GMT

I see what Phoneboy is saying. I recall while ago thats what one of the customers I was helping had to do. Not sure if there is better method these days.

Andy

Re: Change VPN client authentication option

Ruan_Kotze — Tue, 18 Mar 2025 05:39:15 GMT

Yep using SAML and that part is working very well.

Automating re-creating the sites with update_config_tool seems to be going well when manually testing. Need to wrap it inside a PS script then test it as part of push job in Harmony Endpoint today and see where that brings me.

Will share my learnings here if / when I get it going.