2FA not being enforced in Capsule VPN clients (R80.10)

[Antonio_Martins]

VPN client authentication configured with two authentication factors: RADIUS + Dynamic ID

Clients are able to connect only with User+Pass if they use  Capsule VPN Clients - Windows, Android or IOS (capsule connect).

Only way to avoid this is to disable this clients... but I need to use them (certificate authentication).

[PhoneBoy]

Not sure you can configure different authentication schemes for different clients. What does your Gateway Properties > VPN Clients > Authentication show?

[Antonio_Martins]

Currently I have two choices there:

1. Radius, DynamicID

2. Personal Certificate, Username and Password

[Norbert_Bohusch]

For me it sounds like you have configured "multiple login options" that way and this is only supported for some clients. See sk111583 for details.

For other clients you have to rely on the legacy authentication options.

[Antonio_Martins]

Yes, I've configured multiple login options and I know that Capsule VPN clients only support one factor authentication. But the   gateway should enforce two factor and don't allow the connection for this clients.

[Norbert_Bohusch · Accepted solution]

Can you post a screenshot of the following settings:

This might help to see if it is a configuration issue or misbehaving!

[Antonio_Martins]

That's it !!! Never imagined that the setting could be there (allow older clients to connect to the gateway was unchecked).

Many thanks

[Royi_Priov]

Hi Antonio,

I will appreciate if you could open a ticket with TAC for further investigation.

Thanks,

Royi.

[Antonio_Martins]

I will. Thanks.