Remote Server Login
RDP · SSH · Jump hosts
Read more
OpenVPN · Firewall VPNs
MFA for SSL VPN
Step-up authentication in front of remote access, working with OpenVPN and standard firewall VPNs over RADIUS — so remote access hardens without a network redesign.
The challenge
Why this one is hard.
A VPN concentrator that accepts a username and password is a single credential away from handing an attacker a route into your network. Remote access is the most commonly abused entry point precisely because it is designed to be reachable from the internet.
The usual objection is disruption. VPN is business-critical, the user population is large and distributed, and a failed rollout is immediately visible to everybody. That argues for an approach that layers onto the concentrator you already run rather than replacing it.
What changes
| Before | After |
|---|---|
| One leaked VPN credential is a route into the network. | The credential is useless without an out-of-band approval. |
| Remote access is the same for everyone, everywhere. | Geo-fencing and risk scoring apply different rules to different contexts. |
| A suspicious login is noticed days later. | The user can lock their own account the moment an unexpected prompt arrives. |
How it works
Four steps from decision to evidence.
01
Point at RADIUS
The VPN concentrator is configured to authenticate against the platform over RADIUS — a change measured in minutes, not a migration.
02
Pilot
A small group is enrolled and moved onto MFA first, with the existing path still available behind it.
03
Roll out
Remaining users self-enrol through the QR portal, in waves you control.
04
Tighten
Once coverage is proven, the password-only path is closed and policy takes over.
Capabilities
What you get.
- RADIUS integration with OpenVPN and standard firewall VPNs
- Adaptive, risk-based challenge on unusual location or device
- Geo-location aware authentication using GPS and A-GPS
- Offline modes for users with no mobile data while travelling
- Real-time fraud alert so a user can lock their own account instantly
- Phased rollout with both paths live during migration
Supported
- VPN platforms
- OpenVPN · FortiGate · Palo Alto · standard RADIUS concentrators
- Protocols
- RADIUS · SAML · REST API
- Auth modes
- PUSH · QR · FIDO2 passkey · CR-OTP · TOTP · POTP · GRID
- Policy signals
- Device · location · geo-fence · behaviour
Questions
What buyers ask about this.
If yours is not here, our team will answer it directly.
Ask usAlmost certainly. Anything that can authenticate against RADIUS is supported, which covers OpenVPN and the mainstream firewall VPNs. No change to the concentrator beyond pointing it at the platform is normally needed.
Yes. Geo-fencing uses the GPS and A-GPS capabilities of the user's device, so you can permit access only within a designated office, or restrict a travelling employee to a defined set of countries.
That is exactly the signal you want. Real-time fraud alert lets the user reject and lock their account from the prompt itself, which stops the attack and tells your team the credential is compromised.
See this working on your own systems.
Bring the system you are worried about and we will show you exactly how this control would be applied to it.