Second factor from Radius (MFA)

[Ildar07]

Hello.

We have Checkpoint on R77.30. And we want to use multi factor authentication for endpoint VPN clients.

We already have MFA with ASA. MFA based on freeradius with LinOTP. It work fine on ASA: with first factor VPN user input AD credentials and radius check user in AD, and if user is checked radius send challinge response - user see another window. He enter TOTP pin and get authorize.

But when we use same server for checkpoint - it dont work. Second window do not appear. It is looks like checkpoint do not understand "Access-Challenge" from Radius server. This is true?

[the_rock]

R77.30, hope you know its long time not supported. But, lets see if we can help. Can you send some screenshot of the config for this?

Andy

[Ildar07]

Configurations is very simple. I use Radius server for Authentication VPN Users in VPN settings. And I just want to know: does the checkpoint understand "Access-Challenge" from Radius server?

[Chris_Atkinson]

In some configurations you need to append the password+code together.

Again R77.30 is EOL.

[the_rock · Accepted solution]

It does work, I used it before. But again, you are on totally unsupported version, so you would not be able to get any TAC help if needed.

Andy

[PhoneBoy · Accepted solution]

If the user enters their password followed by the MFA code in the password field, it should work.
An "Access Challenge" prompt in RADIUS is currently not supported.