Flex200H - how to setup 2FA for openvpn ?

Asgatlat

hi,

i find a howto for setting up 2FA for SSL Vpn but only for the Zyxel vpn client :

https://mysupport.zyxel.com/hc/en-us/articles/36834960972306-Zyxel-USG-FLEX-H-Firewall-How-to-Use-Two-Factor-with-Google-Authenticator-for-Remote-Access-VPN-and-SSL-VPN#h_01KWCG44DRGJFYTZXH60TQZDKC

i want to do the same but for Openvpn connect client

Zyxel_Tina

Hi @Asgatlat,

Regarding your question, please allow me to clarify that 2FA/MFA support does not depend on SecuExtender client. Two-factor authentication is a firewall-side feature and works with the supported Remote Access VPN types.

Since you prefer to use the OpenVPN client on the USG FLEX 200H, please refer to the following guides:

1. How to configure an SSL VPN connection with the OpenVPN Connect client
2. How to enable 2FA (Google Authenticator) for Remote Access IPSec VPN or SSL VPN — step-by-step configuration

Regarding 2FA behavior on the H series: The VPN tunnel is established first. The user is then required to open the 2FA authorization page in a web browser and enter their username, password, and Google Authenticator code before traffic is allowed. Please ensure that the 2FA authorization page is bound to an interface/IP address that is reachable from the VPN clients (default port: 8008).

Please also note that 2FA requires the SSL VPN sign-on method to be set to Local user — it is not supported when Cloud Authentication is selected.

Why can't I enable 2FA for SSL VPN on USG FLEX H using Google Authenticator? — Zyxel Community