FLEX700H and IPSEC VPN with MFA via e-mail code

NetworkResolve
NetworkResolve Posts: 5  Freshman Member
First Comment Fourth Anniversary
in USG FLEX H Series

I have a Flex700H and i have setup IPSEC VPN for remote users to connect.

When i turn on MFA for each user the only option that is available is Google Auth APP.

I prefer MFA with a authorize e-mail sent to that users e-mail to click auth

I do not user secure extender client due to cost and want to use the native IPSEC VPN with Windows and MAC

does someone know to turn on e-mail MFA for a user on the flex700H versus Google Auth

All Replies

  • Zyxel_Melen
    Zyxel_Melen Posts: 3,816  Guru Member
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate

    Hi @NetworkResolve

    USG FLEX H series doesn't support e-mail MFA, therefore, it is no way to turn this on.

    The reason e-mail MFA is not supported is that receiving the MFA email requires an Internet connection. If you are using IPSec remote access VPN with full tunnel, you won't have Internet access before you pass MFA. Since the Google Auth is an MFA auth tool without Internet, it ensures the user can pass the MFA no matter which remote access VPN type they connect.

    Zyxel Melen


  • PeterUK
    PeterUK Posts: 4,049  Guru Member
    250 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited September 8

    In other words to pass e-mail MFA you would have a PC or laptop for the VPN and a phone to get the Email and link to FLEX to authorize the VPN.

    But one way to to allow VPN to pass authorization is to allow DNS and known EMail ports to get the Email as you authorize the VPN fully.

  • NetworkResolve
    NetworkResolve Posts: 5  Freshman Member
    First Comment Fourth Anniversary

    Zyxel Melen

    MFA if turned on for the IPSEC VPN user with Google Auth setup for that user

    The user connects to VPN via native Apple VPN not secure extender application

    Once the VPN user is connected via IPSEC how does that user apply the Google code to get authorized?

    The VPN shows connected … then what is next step to get authorized with Google Auth?

  • PeterUK
    PeterUK Posts: 4,049  Guru Member
    250 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited September 8

    You enter in the browser your Authorize Link URL Address after you connect to the VPN

    Screenshot 2025-09-08 191944.png

    My LAN DNS point to 192.168.255.235 my LAN interface but externally point to my WAN IP

    https://zyxel-router7.ddns.net:8008

    This open up a page you enter the code

    on another note it by nice if it could use the Certificate to not see click to view unsafe site

  • NetworkResolve
    NetworkResolve Posts: 5  Freshman Member
    First Comment Fourth Anniversary

    PeterUK

    so after you make a successful IPSEC VPN connecting it then opens up the Authorize website on that persons computer were then can then enter the Google Auth code?

    or does the user have to go to the authorize url themselves and type in domain or IP with :8008

  • PeterUK
    PeterUK Posts: 4,049  Guru Member
    250 Answers 2500 Comments Friend Collector Seventh Anniversary

    With built in VPN client you have to go to the authorize url but I think with SecuExtender VPN Client you can make it run the url after connection.

  • Zyxel_Melen
    Zyxel_Melen Posts: 3,816  Guru Member
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate

    Hi @NetworkResolve

    Just like PeterUK mentioned, you need to set the delivery setting for users to enter the Google auth code. Additionally, since the Windows native VPN client's limitation, any user uses the Windows native VPN client to connect the VPN, they need to manually connect the Google auth code page.

    Zyxel Melen


  • NetworkResolve
    NetworkResolve Posts: 5  Freshman Member
    First Comment Fourth Anniversary

    we have to many users to have to purchase the SecuExtender VPN client… It is to expensive for us to use.

  • Fred_77
    Fred_77 Posts: 141  Ally Member
    5 Answers First Comment Friend Collector Fourth Anniversary

    Hi @NetworkResolve

    I'm in the same situation with the native Windows client. To get around the limitation, I use a scheduled task (opens the browser to the authentication code entry page) after VPN connection.

    It's certainly not "THE" solution, but at least it saves the user the hassle of manually opening the browser every time.

    Lorenzo

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）