Apply MFA for VPN

UserLock enforces MFA on VPN connections through its integration with the Microsoft Network Policy Server (NPS).

Two main configurations are possible, depending on your VPN environment:

• VPNs supporting RADIUS Challenge:
  MFA is applied directly through a standard RADIUS flow.

• VPNs supporting RADIUS authentication and accounting:
  Solutions like Microsoft’s Routing and Remote Access Service (RRAS) can use several methods to handle MFA, depending on your configuration and user experience goals. The most seamless approach is to use UserLock VPN Connect, a dedicated client that automatically manages MFA prompts for VPN connections.

The table below summarizes the available methods and their relative ease of use:

1. In the UserLock console, go to Environment ▸ Machines.

2. Locate your NPS server, then click Install in the NPS agent column.

   

   
   

3. Restart both the RemoteAccess and IAS services on the NPS host.

4. Connect once to the VPN and confirm that the user’s VPN session appears in the Activity page in the UserLock console.

This confirms that the NPS agent is correctly installed and communicating with the UserLock service.

For more information, see the guide to install the NPS agent.

1. Open the UserLock Console and go to Access Policies ▸ Add Policy.

2. Follow the general steps described in Configure an access policy until you reach the Policy type selection.

3. Choose Multi-factor authentication to open the MFA policy form.
   

   

4. Set MFA application to Enabled.

5. Choose configuration mode:

   • All at once (same settings for all session types)

   • Distinct setting per session type (recommended, so you can configure MFA separately for VPN connections).

6. Configure VPN session rules

   • For Connection type, choose whether MFA applies to all VPN logons, only remote ones, or only from outside IPs.

   • For MFA frequency, select how often MFA is required (at every logon, at first logon of the day, when connecting from a new IP, etc.).

7. Save the rules
   The policy is now active and will enforce MFA on VPN connections.

VPNs supporting RADIUS Challenge show a second MFA prompt after credentials.
Both RADIUS authentication and accounting must use the NPS server, with PAP authentication enabled.

1. In the UserLock console ▸ Server settings ▸ Advanced ▸ Multi-Factor Authentication, set: MFA VPN Challenge = True

2. Ensure your VPN server uses PAP as the authentication protocol.

1. The user connects to the VPN and enters credentials.

   

   
   

2. The VPN prompts for an OTP or Push confirmation.

   

   
   

3. Access is granted once MFA is successfully validated.

For Microsoft RRAS servers or VPN servers compatible with the Microsoft VPN client, you can use the UserLock VPN Connect app provides a seamless MFA workflow and enrollment.

1. Deploy the VPN Connect app on client computers.

2. Install the UserLock MFA IIS module to allow remote enrollment.

3. Configure the RRAS server to use RADIUS authentication with your NPS server.

• On the first VPN connection, the app detects missing enrollment and opens the UserLock MFA registration page (via UserLock MFA IIS module).
  
  

  

  
  

• Users register and select their preferred authentication method (Push or OTP).

• On subsequent logons, MFA is requested automatically, either via Push approval or OTP entry.
  

  

When using MS-CHAPv2, users can append their MFA code directly to the username during authentication.

1. Ensure a valid policy grants VPN access to the appropriate users.

   

   

2. Add the corresponding Active Directory group under Conditions.

   

• VPN type: Automatic

• Authentication: MS-CHAPv2

At login, users must enter:

• Username: DOMAIN\user,123456

• Password: password

If the VPN uses PAP, the MFA code must be added to the password field.

1. On the NPS server, select only Unencrypted authentication (PAP, SPAP).

   

2. In RRAS:

   • Configure a pre-shared key for L2TP.

     

   • Select PAP as the authentication method.

     

• Connection type: L2TP with IPSec

• Enter the pre-shared key.

• Authentication: PAP

  

At login, users must enter:

• Username: <Domain>\<username>

• Password: <password>,<MFA code>

When using MFA Push with VPN RRAS, both the VPN client timeout and the RADIUS server timeout must be longer than the MFA push timeout defined in UserLock.
This ensures the VPN connection remains active while the user validates the push notification.

• VPN client timeout (Microsoft VPN)

  On the client computer, adjust the following registry key:

  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\PPP\MaxConfigure

  • Type: REG_DWORD

  • Value: Timeout in seconds (default: 10)

    

• RADIUS server timeout (RRAS)

  On the RRAS server, the RADIUS timeout can be configured in the RADIUS server settings.

  

  

  Note

  If the NPS server is installed locally it cannot be changed in the RRAS administration console.

After enabling MFA for VPN sessions, users may be prompted again for credentials when accessing shared folders over VPN.

To avoid this, if the client machine is member of the Active Directory :

1. On the client machine, open:

   %USERPROFILE%\AppData\Roaming\Microsoft\Network\Connections\Pbk

2. Edit rasphone.pbk file.

3. Set this value in the section related to the VPN connection:

   UseRasCredentials=0

UserLock enforces MFA on VPN connections by integrating with the Microsoft Network Policy Server (NPS).

Depending on your VPN setup, MFA can be applied in two ways:

• RADIUS Challenge — The recommended option for VPN clients that support RADIUS Challenge. After entering credentials, users are prompted to verify with their OTP code.

• RRAS method — For Microsoft VPN connections (L2TP, SSTP, PPTP). Users enter their MFA code directly in the username or password field.

Before configuring MFA for VPN:

• ✅️ A Network Policy Server (NPS) with the latest UserLock NPS agent.

• ✅️ RADIUS Challenge: VPN connections must be managed by a VPN server that supports RADIUS Challenge, with RADIUS authentication and RADIUS accounting both configured to use the NPS server. The required authentication protocol is PAP.

• ✅️ Users must be enrolled for MFA before connecting (unless they use the VPN Connect app with RRAS).

1. Run the UserLock console.

2. In the Environment ▸ Machines page, go to the line of the NPS server. In the NPS agents columns, open the agent button and click on Install.

   

3. Restart RemoteAccess and IAS service on the NPS server (more information here)

4. Before enabling MFA, connect to the VPN and make sure the user’s VPN session is visible in the UserLock console.

To enforce MFA on VPN connections, you need to create a new access policy.

👉️ Follow the general steps described in Configure an access policy until you reach the Policy type selection. At this step, choose Multi-factor authentication.

You will then arrive on the MFA rules form.

1. Set MFA application to Enabled.

2. Choose configuration mode:

   • All at once (same settings for all session types)

   • Distinct setting per session type (recommended, so you can configure MFA separately for VPN connections).

3. Configure VPN session rules

   • For Connection type, choose whether MFA applies to all VPN logons, only remote ones, or only from outside IPs.

   • For MFA frequency, select how often MFA is required (at every logon, at first logon of the day, when connecting from a new IP, etc.).

4. Save the rules
   The policy is now active and will enforce MFA on VPN connections.

If your VPN solution supports RADIUS Challenge, this method provides the most user-friendly MFA experience.

• OpenVPN

• Palo Alto

• Fortinet

• Pulse Secure Connect Secure SSL

1. In the UserLock console, go to Server settings ▸ Advanced Settings ▸Multi-Factor Authentication section.

2. Set MFA VPN challenge to True.
   → This applies RADIUS Challenge to all VPN connections protected by UserLock MFA.

1. The user connects to the VPN and enters their credentials.

   

2. A second prompt requests the OTP code.

   

3. The VPN connection is established after successful MFA verification.

If you are using Microsoft’s Routing and Remote Access Service (RRAS) for your VPN server or a VPN not compatible with RADIUS Challenge,
the MFA one-time password (OTP) can be handled in two ways: manually (by adding it to the username or password field) or automatically (through the UserLock VPN Connect application).

UserLock VPN Connect simplifies MFA authentication for RRAS connections.

When a user connects for the first time and MFA enrollment is required:

1. The application detects the missing enrollment and displays a registration window.

2. By clicking Register, the user is redirected to the UserLock MFA enrollment page (UserLock MFA IIS web page).

3. The user chooses their preferred authentication method (Push or TOTP).

Once enrolled, MFA prompts appear automatically during future VPN logons:

• For Push, users approve the request directly.

• For OTP, users enter the code displayed in their authenticator app.

🔗️ For detailed installation steps, see Install VPN Connect for MFA.

On the NPS server:

• Ensure a valid policy grants VPN access to the appropriate users.

  

  

• Add the corresponding Active Directory group under Conditions.

  

On the VPN client:

• VPN type: Automatic

• Authentication: MS-CHAPv2

Users must enter:

Username: <Domain>\<username>,<MFA code>
Password: <password>

✅️ Separate the username and MFA code with a comma.
💡️ Enter the MFA code last, as it changes periodically.
🔑️ For TOTP/HOTP tokens, type the comma, then press the key to input the OTP.

Use the Password Authentication Protocol (PAP) only when encryption is already applied (e.g., L2TP/IPSec or SSTP).

1. On the NPS server, select only Unencrypted authentication (PAP, SPAP).

   

2. In RRAS:

• Configure a pre-shared key for L2TP.

  

• Select PAP as the authentication method.

  

On the VPN client:

• Connection type: L2TP with IPSec

• Enter the pre-shared key.

• Authentication: PAP

  

Username: <Domain>\<username>
Password: <password>,<MFA code>

• VPN client timeout (Microsoft VPN)

  On the client computer, adjust the following registry key:

  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\PPP\MaxConfigure

  • Type: REG_DWORD

  • Value: Timeout in seconds (default: 10)

    

• RADIUS server timeout (RRAS)

  On the RRAS server, the RADIUS timeout can be configured in the RADIUS server settings.

  

  

  Note

  If the NPS server is installed locally it cannot be changed in the RRAS administration console.