topic 2FA not being enforced in Capsule VPN clients (R80.10) in SASE and Remote Access

2FA not being enforced in Capsule VPN clients (R80.10)

Antonio_Martins — Sun, 24 Mar 2019 10:10:19 GMT

VPN client authentication configured with two authentication factors: RADIUS + Dynamic ID

Clients are able to connect only with User+Pass if they use Capsule VPN Clients - Windows, Android or IOS (capsule connect).

Only way to avoid this is to disable this clients... but I need to use them (certificate authentication).

Re: 2FA not being enforced in Capsule VPN clients (R80.10)

PhoneBoy — Sun, 24 Mar 2019 23:23:59 GMT

Not sure you can configure different authentication schemes for different clients. What does your Gateway Properties > VPN Clients > Authentication show?

Re: 2FA not being enforced in Capsule VPN clients (R80.10)

Antonio_Martins — Mon, 25 Mar 2019 01:48:22 GMT

Currently I have two choices there:

1. Radius, DynamicID

2. Personal Certificate, Username and Password

Re: 2FA not being enforced in Capsule VPN clients (R80.10)

Royi_Priov — Mon, 25 Mar 2019 08:30:33 GMT

Hi Antonio,

I will appreciate if you could open a ticket with TAC for further investigation.

Thanks,

Royi.

Re: 2FA not being enforced in Capsule VPN clients (R80.10)

Norbert_Bohusch — Mon, 25 Mar 2019 08:47:48 GMT

For me it sounds like you have configured "multiple login options" that way and this is only supported for some clients. See sk111583 for details.

For other clients you have to rely on the legacy authentication options.

Re: 2FA not being enforced in Capsule VPN clients (R80.10)

Antonio_Martins — Mon, 25 Mar 2019 22:29:12 GMT

Yes, I've configured multiple login options and I know that Capsule VPN clients only support one factor authentication. But the gateway should enforce two factor and don't allow the connection for this clients.

Re: 2FA not being enforced in Capsule VPN clients (R80.10)

Antonio_Martins — Mon, 25 Mar 2019 22:29:52 GMT

I will. Thanks.

Re: 2FA not being enforced in Capsule VPN clients (R80.10)

Norbert_Bohusch — Tue, 26 Mar 2019 07:08:03 GMT

Can you post a screenshot of the following settings:

This might help to see if it is a configuration issue or misbehaving!

Re: 2FA not being enforced in Capsule VPN clients (R80.10)

Antonio_Martins — Wed, 27 Mar 2019 01:14:00 GMT

That's it !!! Never imagined that the setting could be there (allow older clients to connect to the gateway was unchecked).

Many thanks