topic Re: White Paper - RAS VPN with Azure and Microsoft Authenticator MFA in SASE and Remote Access

White Paper - RAS VPN with Azure and Microsoft Authenticator MFA

pwillekens — Thu, 26 Mar 2020 11:37:54 GMT

This is guide will describe the full setup configuration of a Azure MFA using the Microsoft Authenticator App in combination with an Active Directory on-premises synced with Azure Active Directory.

The scope is based on VPN remote access on premises that will be moved to Azure Cloud IaaS. The authentication is Active directory credentials in combination with Azure MFA.

For the full list of White Papers, go here.

Re: White Paper - RAS VPN with Azure and Microsoft Authenticator MFA

SamiH — Tue, 31 Mar 2020 14:12:53 GMT

After reading the paper, I think this works with local AD too, without Cloudguard or Azure AD? As it happens, I have a need to combine RADIUS MFA with Identity awareness. Currently we are using RADIUS MFA but the identities won't match AD users even though the used email addresses are the same as in AD accounts.

Re: White Paper - RAS VPN with Azure and Microsoft Authenticator MFA

Paul_Manalaysay — Wed, 10 Jun 2020 07:45:59 GMT

Hello, does this guide also works on Mobile Access VPN? The Portal-based one?

Re: White Paper - RAS VPN with Azure and Microsoft Authenticator MFA

pwillekens — Wed, 10 Jun 2020 07:48:53 GMT

Hi Paul,

I didn't set it up for mobile Acces, but it should work as the procedure is the same.

Re: White Paper - RAS VPN with Azure and Microsoft Authenticator MFA

Paul_Manalaysay — Thu, 11 Jun 2020 03:48:24 GMT

Thanks a lot!

Re: White Paper - RAS VPN with Azure and Microsoft Authenticator MFA

Jonathan — Thu, 27 Aug 2020 06:39:28 GMT

Hi Sami,

Did you ever managed to apply this solution with on-premis AD and without Cloudguard?

Re: White Paper - RAS VPN with Azure and Microsoft Authenticator MFA

SamiH — Thu, 27 Aug 2020 06:49:55 GMT

We actually have the older MS MFA component which can no longer be downloaded. The new one uses explicitly the Azure AD sync.

It works with the old one, which syncs user information locally to our on-prem MFA/NPS/Radius server - which in turn talks to Azure to send the authentication verification request to user.

Re: White Paper - RAS VPN with Azure and Microsoft Authenticator MFA

Jonathan — Thu, 27 Aug 2020 07:36:56 GMT

and do you use Cloudgard or regular on-premise VPN?

Re: White Paper - RAS VPN with Azure and Microsoft Authenticator MFA

SamiH — Thu, 27 Aug 2020 08:15:41 GMT

Just regular on-premise vpn from Check Point gw's. I would assume it works with on-prem vpn with newer Azure MFA + AD sync to Azure, without Cloudguard still.

Re: White Paper - RAS VPN with Azure and Microsoft Authenticator MFA

pwillekens — Tue, 15 Sep 2020 12:17:04 GMT

sorry for the delay response, no i didn't apply this on premises.

Re: White Paper - RAS VPN with Azure and Microsoft Authenticator MFA

pwillekens — Tue, 15 Sep 2020 12:17:49 GMT

It should wokr on both as long the initial Radius request is send to the NPS server

Re: White Paper - RAS VPN with Azure and Microsoft Authenticator MFA

am — Wed, 23 Dec 2020 10:35:59 GMT

I recommend adding instructions on how to update radius timeouts and retries when using MFA push notifications. 2 retries is too short.