SonicWall VPN 2FA

This guide describes how to set up two-factor authentication (2FA) for your SonicWall VPN solution with Protectimus as a multi-factor authentication (MFA) provider.

The Protectimus two-factor authentication system can be integrated with SonicWall SSL VPN via RADIUS authentication protocol. For this purpose, you need to install an on-premise Protectimus RADIUS Server component and configure the SonicWall Network Security Appliance to refer to the Protectimus RADIUS Server for user authentication.

See how Protectimus two-factor authentication solution works for SonicWall VPN in the scheme below.

1. How Two-Factor Authentication for SonicWall VPN Works

Protectimus adds the second authentication factor to your users’ login to the SonicWall VPN. After you set up SonicWall VPN two-factor authentication, your users will enter two different authentication factors when they log into their SonicWall VPN accounts. These authentication factors are:

1. Basic credentials – username and password (something the user knows).
2. A one-time password generated with the help of a two-factor authentication token (something that belongs to the user).

Protectimus offers different kinds of two-factor authentication tokens for SonicWall:

• Classic and programmable hardware OTP tokens that look like keyfobs and plastic cards;
• 2-factor authentication app Protectimus SMART OTP on iOS and Android
• Any other 2-factor authentication apps that support TOTP auth standard, including Google Authenticator;
• Delivery of one-time passwords using chatbots in Telegram, Messenger, or Viber;
• SMS authentication;
• Delivery of one-time passwords via email.

You may enable one authentication method for all your users or let users a chance to choose themselves if you activate the Protectimus Users’ Self-Service Portal.

Two-factor authentication protects SonicWall VPN from many threats associated with stealing users’ credentials, including phishing, social engineering, brute force, keyloggers, data spoofing, etc.

It is a challenging task for the fraudster to hack two authentication factors that differ in their nature (something the user knows and owns) and use them simultaneously within 30 seconds (the time when the one-time password remains active). That is why two-factor authentication is still one of the best security measures for SonicWall VPN.

2. How to Enable SonicWall VPN 2FA

You can set up SonicWall VPN two-factor authentication (2FA) with Protectimus using the RADIUS protocol:

1. Get registered with Protectimus SAAS Service or install the On-Premise 2FA Platform and configure basic settings.
2. Install and configure Protectimus RADIUS Server.
3. Configure SonicWall VPN authentication policies.

2.1. Get Registered and Configure Basic Protectimus Settings

1. Register with the Protectimus Cloud Service and activate API or install the Protectimus On-Premise Platform (if you install Protectimus Platform on Windows, check the RProxy box during the installation).
2. Add Resource.
3. Add Users.
4. Add Tokens or activate Users’ Self Service Portal.
5. Assign Tokens to Users.
6. Assign Tokens with Users to the Resource.

2.2. Install and Configure Protectimus RADIUS Server

Detailed instructions for installing and configuring the Protectimus RADIUS Server for SonicWall VPN 2-factor authentication using RADIUS are available here.

2.3. Add Protectimus as RADIUS Server for SonicWall

Below you will find two instructions for adding Protectimus as RADIUS Server to the SonicWall Network Security Appliance:

• For SonicOS 6.2 and below versions.
• For SonicOS 6.5 and above versions.

2.3.1. SonicOS 6.2 and below

1. Log into the SonicWall administrative interface.
2. Navigate to Users –> Settings –> Authentication method for login and select RADIUS. Then click on Configure.

3. Configure the following RADIUS Settings to add a RADIUS Server.

RADIUS Server Timeout	Set to 30 seconds or higher. This is to make sure that login has enough time to receive the OTP and enter it.
Name or IP Address	IP of server where the Protectimus RADIUS Server component is installed.
Shared Secret	Indicate the shared secret you created in the Protectimus radius.yml file (radius.secret property) when configuring Protectimus RADIUS Server
Port Number	Indicate 1812 (or whichever port you configured in the Protectimus radius.yml file when configuring Protectimus RADIUS Server).

4. Go to the RADIUS Users tab. Select appropriate mechanism for setting user group membership, Apply settings, and test the configuration.

2.3.2. SonicOS 6.5 and above

1. Log into the SonicWall administrative interface.
2. Click MANAGE, navigate to Users –> Settings –> User authentication method and select RADIUS. Then click on CONFIGURE RADIUS.

3. Click Add and then configure the following RADIUS Settings to add a RADIUS Server.

Host Name or IP Address	IP of server where the Protectimus RADIUS Server component is installed.
Shared Secret	Indicate the shared secret you created in the Protectimus radius.yml file (radius.secret property) when configuring Protectimus RADIUS Server
Confirm Shared Secret	Confirm your shared secret.
Port	Indicate 1812 (or whichever port you configured in the Protectimus radius.yml file when configuring Protectimus RADIUS Server).

4. While still in RADIUS Servers Settings, switch to General Settings and Set RADIUS Server Timeout to 30 seconds or higher.

5. Go to the RADIUS Users tab. Select appropriate mechanism for setting user group membership, click OK, and test the configuration.

Integration of two-factor authentication (2FA/MFA) for your SonicWall VPN is now complete. If you have other questions, contact Protectimus customer support service.