Has anyone got this combo working? The salespeople are really pushing Authpoint, but I’d like to avoid making my users install another MFA app on their phone. All of our other apps integrate with Azure AD and send push notifications through Microsoft Authenticator.
It would be really nice if we could make SSL VPN work with Azure MFA.
Yep you can do it. I set it up back when we went WFH in 2020.
2 caveats:
You have to run an on-prem AD and NPS server with the Azure AD NPS extension (Use Microsoft Entra multifactor authentication with NPS - Microsoft Entra ID | Microsoft Learn) note that installing the NPS extension on a RADIUS server will force ALL authentication requests to that server to use MFA, so you pretty much need a separate dedicate NPS sever for VPN authentication. Don’t install the extension on an existing production RADIUS server.
You can only use MS Authenticator app push notifications or phone call for MFA. OTP codes did not work.
There is apparently a workaround for #2 that was posted by an MS employee in a blog to allow either sms or other OTP methods like hardware tokens but I haven’t bothered since we have all our users trained to use the app and have no complaints.
Also, as an aside, you can use the OpenVPN Connect client instead of the Watchguard client. It’s much more flexible. I have a script in our connection file to bypass the VPN to connect to MS365 because teams calls were really choppy when going through the VPN. The WG client just dumps everything through the VPN when connected.
FYI, you can split tunnel with the WG client. You can create a policy for the VPN user and specify which resources it can access, it will create the routes for just those networks when you connect.
So I already have this setup in place, and the MFA works if using L2TP or IKEv2, but I can’t for the life of me get the MFA prompt to work for the mobile SSL VPN client. Is there a magic trick in getting it to work?
Also, could I steal your o365 script? That sounds marvelous.
This pretty much covers it. Pretty easy to setup once you know about point #1
The built in Watchguard spit tunnel settings are limited to 1 internal domain only. In our case we needed 2 domains (that’s a long story and something I inherited) so that’s why we ended up with the custom settings in OpenVPN.
We don’t use L2TP or IKEv2 so I can’t speak to those. Are you seeing the MFA authentication attempts in the Security logs in event viewer on the NPS server?
Also, I’m not quite sure what you mean about “can’t for the life of me get the MFA prompt to work for the mobile SSL VPN client”. We don’t receive any MFA prompts in the VPN client itself, just the push notification in the Microsoft Authenticator app. If the user doesn’t respond to the Authenticator prompt the client just times out.
For the login script I started by downloading the client.ovpn file from the WG web console at VPN → Mobile VPN → Download Client button → Mobile VPN with SSL client profile.
Then after the tls-version-min 1.2 line I pasted these routes:
route 13.107.6.152 255.255.255.254 net_gateway
route 13.107.6.171 255.255.255.255 net_gateway
route 13.107.18.10 255.255.255.254 net_gateway
route 13.107.18.15 255.255.255.255 net_gateway
route 13.107.64.0 255.255.192.0 net_gateway
route 13.107.128.0 255.255.252.0 net_gateway
route 13.107.136.0 255.255.252.0 net_gateway
route 13.107.140.6 255.255.255.255 net_gateway
route 20.190.128.0 255.255.192.0 net_gateway
route 23.103.160.0 255.255.240.0 net_gateway
route 40.92.0.0 255.254.0.0 net_gateway
route 40.96.0.0 255.248.0.0 net_gateway
route 40.104.0.0 255.254.0.0 net_gateway
route 40.107.0.0 255.255.0.0 net_gateway
route 40.108.128.0 255.255.128.0 net_gateway
route 40.126.0.0 255.255.192.0 net_gateway
route 52.96.0.0 255.252.0.0 net_gateway
route 52.100.0.0 255.252.0.0 net_gateway
route 52.104.0.0 255.252.0.0 net_gateway
route 52.108.0.0 255.252.0.0 net_gateway
route 52.112.0.0 255.252.0.0 net_gateway
route 52.120.0.0 255.252.0.0 net_gateway
route 52.238.78.88 255.255.255.255 net_gateway
route 52.238.106.116 255.255.255.255 net_gateway
route 52.238.119.141 255.255.255.255 net_gateway
route 52.244.37.168 255.255.255.255 net_gateway
route 52.244.160.207 255.255.255.255 net_gateway
route 52.244.203.72 255.255.255.255 net_gateway
route 52.244.207.172 255.255.255.255 net_gateway
route 52.244.223.198 255.255.255.255 net_gateway
route 52.247.150.191 255.255.255.255 net_gateway
route 104.47.0.0 255.255.128.0 net_gateway
route 104.146.128.0 255.255.128.0 net_gateway
route 131.253.33.215 255.255.255.255 net_gateway
route 132.245.0.0 255.255.0.0 net_gateway
route 150.171.32.0 255.255.252.0 net_gateway
route 150.171.40.0 255.255.252.0 net_gateway
route 204.79.197.215 255.255.255.255 net_gateway
Again, this is only when using the OpenVPN Connect client, not the Watchguard SSLVPN client. I adapted the routes from the below script which scrapes the custom output for your tenant from https://endpoints.office.com/. You might want to run the script on that GIT repository with your tenant UUID in case your IP ranges are different depending on your location.