Flex 100H V1.36 Remote VPN With 2FA Support

JCE

Hi,

We have a Flex 100H FW V1.36.

We are wanting to setup remote users to have access to our network using VPN through the Flex

Do we have to buy the Secuextender client to be able to use 2FA/MFA with the connection or can you use other clients that are FOC i.e. Open VPN etc.

Many thanks for any advice.

PeterUK

Yes you can use Open VPN, strongSwan or MS built in client with FLEX H but when connected you must bring up the LAN Authorize Link URL Address like HTTPS://192.168.255.235:8008 or HTTPS://zyxel-router7.ddns.net:8008

Zyxel_Tina

Hi @JCE,

Regarding your question, please allow me to clarify that 2FA/MFA support does not depend on the SecuExtender functionality. Two-factor authentication is a firewall-side feature, and it works with several supported Remote Access VPN types, regardless of whether you use SecuExtender clients (which require a license).

Instead of purchasing the SecuExtender license, if you prefer to use other free VPN, you may choose OS-native or OpenVPN clients on the USG FLEX H series, as this series supports multiple Remote Access VPN options. This allows you to establish a secure VPN connection without needing SecuExtender.

1. IPsec VPN

IPsec Remote Access supports OS-native VPN clients (e.g., Windows, macOS/iOS, strongSwan). For reference, here is our guide for IKEv2 over IPsec configuration on FLEX H:

https://community.zyxel.com/en/discussion/30508/how-to-configure-l2tp-vpn-on-usg-flex-h-on-nebula

2. SSL VPN

Our firewalls also support using OpenVPN client to connect to the device’s SSL VPN service.

https://community.zyxel.com/en/discussion/20526/how-to-configure-ssl-vpn-connection-with-openvpn-connect-client

3. 2FA / MFA Support

To enable 2FA (Google Authenticator) for Remote Access IPsec VPN or SSL VPN, please refer to the following FAQ for step-by-step configuration:

https://community.zyxel.com/en/discussion/27810/usg-flex-h-how-to-set-up-2fa-with-google-authenticator-for-remote-access-vpn-and-ssl-vpn

PeterUK

Yes you can use Open VPN, strongSwan or MS built in client with FLEX H but when connected you must bring up the LAN Authorize Link URL Address like HTTPS://192.168.255.235:8008 or HTTPS://zyxel-router7.ddns.net:8008

Zyxel_Tina

Hi @JCE,

Regarding your question, please allow me to clarify that 2FA/MFA support does not depend on the SecuExtender functionality. Two-factor authentication is a firewall-side feature, and it works with several supported Remote Access VPN types, regardless of whether you use SecuExtender clients (which require a license).

Instead of purchasing the SecuExtender license, if you prefer to use other free VPN, you may choose OS-native or OpenVPN clients on the USG FLEX H series, as this series supports multiple Remote Access VPN options. This allows you to establish a secure VPN connection without needing SecuExtender.

1. IPsec VPN

IPsec Remote Access supports OS-native VPN clients (e.g., Windows, macOS/iOS, strongSwan). For reference, here is our guide for IKEv2 over IPsec configuration on FLEX H:

https://community.zyxel.com/en/discussion/30508/how-to-configure-l2tp-vpn-on-usg-flex-h-on-nebula

2. SSL VPN

Our firewalls also support using OpenVPN client to connect to the device’s SSL VPN service.

https://community.zyxel.com/en/discussion/20526/how-to-configure-ssl-vpn-connection-with-openvpn-connect-client

3. 2FA / MFA Support

To enable 2FA (Google Authenticator) for Remote Access IPsec VPN or SSL VPN, please refer to the following FAQ for step-by-step configuration:

https://community.zyxel.com/en/discussion/27810/usg-flex-h-how-to-set-up-2fa-with-google-authenticator-for-remote-access-vpn-and-ssl-vpn

JCE

Thank you both for quick answers. 👍️