topic Re: How to configure C2S VPN with AzureAD and 2FA in SASE and Remote Access

White Paper - How to configure C2S VPN with AzureAD and 2FA

Jonathan_James — Fri, 03 Apr 2020 09:40:01 GMT

Hi Folks,

Well this is my first post here, figured I would create a quick document for a few of my customers but there has been a wider interest in it as well.

Create new public DNS domain
Added domain as a “Custom domain name” in AzureAD
Created 2019 AD domain on prem
Installed NPS onto AD server
** STOP AND TEST RADIUS **
Installed Azure AD Connect and began AD sync to cloud
Installed “Network Policy Server extension for Azure” on top of NPS
Test

The way I have it setup is the gateway sends a RADIUS request to MS NPS, NPS auths’s against AD, if successful NPS will send it to AzureAD for OTP creation, MS will then send the OTP via SMS or email to the end user.

For the full list of White Papers, go here.

This is tested with a 750 running latest code as the gateway, SecureClient on the user PC and Capsule VPN on windows10

happy to answer questions or provide more info if needed.

Re: How to configure C2S VPN with AzureAD and 2FA

PhoneBoy — Thu, 02 Apr 2020 21:35:39 GMT

Tagging @_Val_, we probably need to treat this as a whitepaper.

Re: How to configure C2S VPN with AzureAD and 2FA

_Val_ — Fri, 03 Apr 2020 09:38:11 GMT

Yes, master, it is a white paper now

Re: How to configure C2S VPN with AzureAD and 2FA

JT_Roomspace — Mon, 11 May 2020 14:25:30 GMT

Hello everyone,

can someone explain me the option on the Radius settings?

"Ask user for password (will be used to automatically answer the first challenge)".

we are planning to do the same config on SMB devices too and there I dont have this option.

Thanks in advance.

Re: How to configure C2S VPN with AzureAD and 2FA

JT_Roomspace — Mon, 11 May 2020 14:29:23 GMT

Hello everyone,

can someone please explain me this option on the Radius setting.
"Ask user for password (will be used to automatically answer the first challenge)".
Im trying to setup a SMB device and dont have this option.

thanks in advance