ZyWALL SecuExtender Two-Factor Authentication

Warley

Good afternoon

I enabled the two-factor authentication method via Google Authenticator, but here we use ZyWALL SecuExtender to connect via VPN. When I log in, it goes straight in without requesting authentication via Google Authenticator, does anyone know what it could be?

Print

Log in through this software and do not ask for authentication.

PeterUK

test by Email two-factor authentication method

valerio_vanni

It's clear that you don't get 2FA page.

But

"it goes straight in without requesting authentication via Google Authenticator".

Means "the tunnel goes up and then it's working" or "the tunnel goes up and then it's not working"?

By "working" I mean "really working", traffic can flow.

Zyxel_Melen

Hi @Warley,

Did you enable Two-factor Authentication for VPN Access?

In addition, the SecuExtender for SSL VPN of your version doesn't support auto popout the authentication page. You need open it manually.

Warley

In this case, because of this software that I connect to the VPN, I wouldn't be able to use this feature? What else would you give?

Below images, even with the settings connect without two-factor authentication.

valerio_vanni

Connected, but does traffic flow?

Warley

In fact, it seems connected, but not flowing.

PeterUK

You have to use the authorize link to enter a code which works when you get a Email but I have not been able to get it to work with google authenticator

Zyxel_Melen

Hi @Warley,

In this case, because of this software that I connect to the VPN, I wouldn't be able to use this feature?

You can use the 2FA authentication feature. Please also enable 2FA authentication for VPN access. The path is Menu > Configuration > Object > Auth. Method > Two-factor Authentication > VPN Access.

Since your SSLVPN SecuExtender version doesn't support automatically popping out the authorized web page, you need to open your browser manually to access it.

Once your setting is the same as above, you need to use the URL "https://<firewall WAN IP address>:<Authorized port>". For example, "https://10.20.48.254:8008"

valerio_vanni

https://community.zyxel.com/en/discussion/comment/72272#Comment_72272

This, by itself, seems the correct state before 2FA process.

Have you tried to open by hand, at that point, authorization page?

Warley

Good afternoon

As shown in the image below, accessing it via the web worked.

I was able to use it by going to the web page and placing the code that was generated for the user.

However, I found the method not very effective because the authorization codes run out and I will have to interfere later, as here some users connect all the time and I would need a faster check, perhaps because of email, but I was unable to configure it via email. Has anyone managed to get it to work via email?