L2TP VPN NPS-Server and PEAP or EAP-MSChapv2

Hello Communiity,

I would like to achieve the same. Is this possible or does anybody made any experience if PEAP or EAP-MSChapv2 against a Microsoft NPS-Server can be used for an VPN solution?

In General the customer requirement is to use an Certificate based authentication for his VPN connection using an Radius (NPS Server). As we all know, using Username & Password and OTP is phishable.

Any alternative approaches for an Certificate based authentication for a VPN connection.

thanks

Here are all supported methods: https://support.sophos.com/support/s/article/KB-000035745?language=en_US

Thx for the quick response on my question.

So do I understand this correctly, that it is not possible today to make use an Smartcard Certificate based authentication for an VPN connection? Based on my understanding you need to use PEAP or EAP for an certificate based smartcard login when using NPS?

That is my understanding too. 

Are there any plans to integrate the PEAP Authentication protocol in the future so that the XG would support a Certificate based smartcard login for VPN.

Also any does Sophos have any plans to to integrate the FIDO2 authentication Protocol for the XG in the Future?

https://fidoalliance.org/specifications/

thx 

Many customers move to Azure AD and use the Multifactor of Azure for this purpose. The other integrations are planned for the future. 

Thx Lucar for your response! You guys really are quick 

When using AAD MFA in combination with XG you would still need a Radius Server (NPS)? Do you have a Guide how this could be achieved? 

Based on my understanding also AAD MFA does not support a Certificate based smartcard login. Correct?

Could you give my a rough time estimate for when the other integrations are planed?

Thx Lucar for your response! You guys really are quick 

When using AAD MFA in combination with XG you would still need a Radius Server (NPS)? Do you have a Guide how this could be achieved? 

Based on my understanding also AAD MFA does not support a Certificate based smartcard login. Correct?

Could you give my a rough time estimate for when the other integrations are planed?