USG FLEX 50W 2FA If WAN Down

DeanH

Hello ZyXEL Community,

I am planning on implementing 2FA as mandatory on all our future base configurations, but my concern is what occurs when the WAN is dead?

If, for some reason, the WAN connection dies and the customer has to change to another one in an emergency - particularly with a static IP - how does 2FA work on the LAN since it obviously cannot reach the 2FA servers any more?

Or, is it just that we have to build a backup user to use only in those instances since the main admin user is toast due to 2FA?

I'm trying to think of all caveats before implementing as I want to build futureproofing into the config. Most of our sites are in other states, so sending people out to them doesn't help in the here and now emergency case.

Zyxel_Jeff

Hi @DeanH

Please refer to this FAQ article: If the WAN port is down, can the user still log in to the device using a 2FA code?

https://community.zyxel.com/en/discussion/18690/if-the-wan-port-is-down-can-the-user-still-log-in-to-the-device-using-a-2fa-code

Thanks.

Zyxel_Jeff

Hi @DeanH

If the WAN is down, you still can use the Google Authenticator code or the backup codes(as the below screenshot) to complete the 2FA procedure and login to your device. Thanks.

Zyxel_Jeff

Hi @DeanH

Please refer to this FAQ article: If the WAN port is down, can the user still log in to the device using a 2FA code?

https://community.zyxel.com/en/discussion/18690/if-the-wan-port-is-down-can-the-user-still-log-in-to-the-device-using-a-2fa-code

Thanks.

DeanH

Hello Zyxel_Jeff,

Thank you for your response.

That is what I needed. For some reason, that didn't show up in my search.