multi-factor authentication

Question

Hello, how do I implement multi-factor authentication for the XG firewall. At least a smart-card or certificate based logon? 
 I find that access to the administrative interface of the appliance with only a username and password is not a correct security policy. 
 This is also true for users accessing the portal from the public Internet.

sachingurung · Answer

Hi, 
 If you are trying to implement two-factor authentication where a User should go through two level of authentication processes, then I suggest you implement Radius server which supports two factor and configure it in XG. 
 Thanks

DannyOosterveer · Answer

Hi, 
 You need a 3rd-party solution that will handle the 2FA for you, most of these solutions rely on Radius as Sachin already mentioned. 
 On Cyberoam I used Swivel Secure to handle the 2FA. Haven't worked with Swivel on SF_OS / XG, but I suppose it will work. 
 
 Cheers 
 Danny Oosterveer 
 Cyberoam CCT | Sophos XG Architect

harrisonpensa · Answer

I know this thread is a bit old, but I am trying to set up MFA using the XG and MS Azure MFA. The setup works except, the XG appears to be hard coded to time out the Radius Auth after about 6 or 7 seconds. Because of this, almost all authentications time out during the time it takes the radius server to do the phone call/app auth process. 
 There needs to be a time out setting on the XG such at 15 or 20 seconds to allow sufficient time for the radius server verify the end user via cell phone. The hard coded 5 to 7 seconds is only good for a straight single factor radius authentication. 
 Therefore, unless you can complete your 2nd factor auth in under 5 to 7 seconds which is nearly impossible, you cannot successfully set up MFA on the XG. 
 
 THIS NEEDS TO BE ADDRESSED!!!!