[NEBULA] integrate vpn cloud authentication with CensorNet (formerly SMS Passcode)

FrankIversen · August 2017

Hi.
Is there any plans of supporting MFA with the client ipsec vpn tunnel using cloud authentication? it works very nice with regular Radius with the zyxel usg firewall.
I have asked the support at Censornet and they think this is intereseting and would like to participte in a test with Nebula if the cloud authenation also uses some kind of radius in the background which they support. Here is the mail I got from Censornet:

I have not been working with this product before.

Since it is a L2TP ipsec tunnel, i would say the chance is small, but i found this document.:
https://kb.zyxel.com/KB/searchArticle!gwsViewDetail.action?articleOid=015899&lang=EN

This however do not reveal any details regarding how the radius protocol has been implemented. They must support XAUTH and Radius challenge response over the protocols PAP and/or MSChapV2.

I know that Zyxel Zywall 200 (USG200), has a perfect implementation of Radius. That does however not mean that the Nebula cloud do.

I can assist in a test, if needed.

Kind regards
Gunnar Hermansen
@gundaris

RUnglaube · August 2017

hmmmm sounds interesting! I'm not sure if it could be implemented with cloud auth, have you tried using the my radius or AD servers settings combined with Azure radius and MFA for example? I don't know about Censornet so not sure how to implement it

Zyxel_Irene · August 2017

Hi @FrankIversen
Sounds great, and it will be more safer for enterprise and users when user connect to L2TP VPN.

NSG could support PAP and MSChapv2 protocol at this stage, but there is no way to enable MFA function on NCC to trigger MFA...
I also would like to suggest you can share this idea in idea section.

FrankIversen · February 2018

Hi, what is the status on MFA for vpn connection? This is a must if we should enable VPN for remote users.

Hello_Geek · February 2018

I see you have some posts mentioned about MS Azure, so I suppose...

if you connect L2TP VPN auth with Azure MFA Server (as RADIUS server), you can have the second factor auth through MFA server and Azure to achieve.

FrankIversen · March 2018

No problem with MFA regarding Azure, but for customer who wants to connect to their own on-premise network (small SMBs with f.ex 5 users) they don't have an Azure solution for this. They use the VPN-function on the NSG50.