Checkpoint Mobile VPN with multiple MFA types?

[jwmac]

We currently have an on premise installation of RSA SecurID.  We have our checkpoint firewall configured to use the RSA SecurID for 2FA using hard and soft tokens for our CheckPoint Mobile VPN clients .  

We are looking into purchasing onelogin which apparently can provide MFA for checkpoint mobile VPN via cloud radius.

Is it possible to setup and have multiple MFA types for Checkpoint Mobile VPN access at one time?  Essentially, we would leave our current RSA setup in place and existing users can continue to use their RSA tokens while we add the new MFA service through onelogin. We would then have MFA through onelogin setup in parallel to RSA on the checkpoint. We could then test MFA with onelogin and any new Checkpoint Mobile users  would be setup to use onelogin.  This is the theory anyway.

Is this possible to accomplish?

[PhoneBoy]

You would have to put the users into a different LDAP group to support this, I believe.