topic VPN defined on user record not enforced in SASE and Remote Access

VPN defined on user record not enforced

stefan_o — Tue, 07 Apr 2026 11:25:11 GMT

Hi all!

We have this settings on our FW R81.20 for VPN-Clients:

Then i have this user, which needs Radius but also has a certificate:

Radius (duo proxy) is used for MFA only.

Now when i connect with a VPN-Client and use the certificate the connection is working - i would expect to be asked for the 2nd factor via radius.

Am i getting something wrong?

Re: VPN defined on user record not enforced

PhoneBoy — Tue, 07 Apr 2026 14:54:35 GMT

I'm fairly certain that if you're using "defined on user record" only one authentication method is supported.
You need to set up the Multiple Login Options to specify both Certificate and RADIUS are required.

Re: VPN defined on user record not enforced

simonemantovani — Tue, 07 Apr 2026 14:59:22 GMT

Hello

I agree with @PhoneBoy if you want to use DUO MFA with Radius, you should create a specific authentication method in Multiple login option and follow this link to confnigure authenticatio: https://community.checkpoint.com/t5/SASE-and-Remote-Access/Configuring-Checkpoint-Remote-VPN-for-MFA/td-p/197812

I always configured VPN with MFA (DUO and Radius) following the above link.