{"id":18138,"date":"2026-07-02T11:39:03","date_gmt":"2026-07-02T11:39:03","guid":{"rendered":"https:\/\/www.protectimus.com\/?page_id=18138"},"modified":"2026-07-06T14:13:35","modified_gmt":"2026-07-06T14:13:35","slug":"radius-authentication","status":"publish","type":"page","link":"https:\/\/www.protectimus.com\/ru\/radius-authentication\/","title":{"rendered":"RADIUS Authentication with MFA: Secure Every Network Access Point"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-page\" data-elementor-id=\"18138\" class=\"elementor elementor-18138\" data-elementor-post-type=\"page\">\n\t\t\t\t<div class=\"elementor-element elementor-element-223acb9 padded e-flex e-con-boxed e-con e-parent\" data-id=\"223acb9\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-e4740cc elementor-widget elementor-widget-heading\" data-id=\"e4740cc\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h1 class=\"elementor-heading-title elementor-size-default\">RADIUS Authentication with MFA: Secure Every Network Access Point<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-b4a66c0 e-con-full e-flex e-con e-child\" data-id=\"b4a66c0\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-0870f66 e-con-full e-flex e-con e-child\" data-id=\"0870f66\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-e128a97 elementor-widget elementor-widget-text-editor\" data-id=\"e128a97\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>RADIUS \u2014 the protocol that quietly handles authentication for most corporate VPNs, Wi-Fi networks, and network infrastructure \u2014 was built for a different era. It does its job reliably: a network device sends credentials to a RADIUS server, the server checks them against a directory, and access is granted or denied. What it doesn&#8217;t do is verify that the person entering those credentials is actually who they claim to be. A stolen password is as good as a real one.<\/p><p>Adding MFA to RADIUS closes that gap. Instead of replacing your existing infrastructure, a RADIUS proxy sits between your network devices and your directory \u2014 enforcing a second factor on every authentication request before issuing an Access-Accept.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-20c72f6 elementor-widget elementor-widget-html\" data-id=\"20c72f6\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"html.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<script type=\"application\/ld+json\">\r\n{\r\n  \"@context\": \"https:\/\/schema.org\",\r\n  \"@type\": \"BreadcrumbList\",\r\n  \"itemListElement\": [\r\n    {\r\n      \"@type\": \"ListItem\",\r\n      \"position\": 1,\r\n      \"name\": \"Home\",\r\n      \"item\": \"https:\/\/protectimus.com\/\"\r\n    },\r\n    {\r\n      \"@type\": \"ListItem\",\r\n      \"position\": 2,\r\n      \"name\": \"Solutions\",\r\n      \"item\": \"https:\/\/protectimus.com\/solutions\/\"\r\n    },\r\n    {\r\n      \"@type\": \"ListItem\",\r\n      \"position\": 3,\r\n      \"name\": \"RADIUS Authentication with MFA\",\r\n      \"item\": \"https:\/\/protectimus.com\/radius-authentication\/\"\r\n    }\r\n  ]\r\n}\r\n<\/script>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-42bfc14 e-con-full e-flex e-con e-child\" data-id=\"42bfc14\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-6818e9e elementor-widget elementor-widget-heading\" data-id=\"6818e9e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Table of Contents<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-282e74f elementor-widget elementor-widget-text-editor\" data-id=\"282e74f\" data-element_type=\"widget\" data-e-type=\"widget\" id=\"why-on-premise-mfa-matters-2026\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<ol>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"#what-is-radius\"><span style=\"font-weight: 400;\">What Is RADIUS Authentication and Why It Needs MFA<\/span><\/a><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"#how-protectimus-adds-mfa\"><span style=\"font-weight: 400;\">How Protectimus Adds MFA to RADIUS Authentication<\/span><\/a><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"#supported-mfa-methods\"><span style=\"font-weight: 400;\">Supported MFA Methods for RADIUS<\/span><\/a><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"#supported-radius-equip\"><span style=\"font-weight: 400;\">Supported RADIUS Clients &amp; Network Equipment<\/span><\/a><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"#radius-mfa-for-vpn\"><span style=\"font-weight: 400;\">RADIUS MFA for VPN<\/span><\/a><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"#radius-mfa-for-wlan-access\"><span style=\"font-weight: 400;\">RADIUS MFA for Wireless Network Access<\/span><\/a><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"#deployment-opt\"><span style=\"font-weight: 400;\">Deployment Options<\/span><\/a><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"#system-requirements\"><span style=\"font-weight: 400;\">System Requirements &amp; Integration<\/span><\/a><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"#radius-setup\"><span style=\"font-weight: 400;\">Step-by-Step: How to Set Up RADIUS MFA in 5 Steps<\/span><\/a><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"#radius-mfa-compliance\"><span style=\"font-weight: 400;\">Compliance: How RADIUS MFA Satisfies Regulatory Requirements<\/span><\/a><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"#radius-mfa-faq\"><span style=\"font-weight: 400;\">Frequently Asked Questions<\/span><\/a><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"#get-protected\"><span style=\"font-weight: 400;\">Start Securing Your Network Access Today<\/span><\/a><\/li>\n<\/ol>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-b904199 padded e-flex e-con-boxed e-con e-parent\" data-id=\"b904199\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-1b1c9bb e-con-full e-flex e-con e-child\" data-id=\"1b1c9bb\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-f07f411 elementor-widget elementor-widget-heading\" data-id=\"f07f411\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Quick Answer<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-54d9acf elementor-widget elementor-widget-text-editor\" data-id=\"54d9acf\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">RADIUS (Remote Authentication Dial-In User Service) is the backbone of network access control in most enterprise environments \u2014 handling authentication for VPNs, corporate Wi-Fi, network access devices, NPS, and VDI gateways. The protocol itself, defined in <\/span><a target=\"_blank\" target=\"_blank\" href=\"https:\/\/datatracker.ietf.org\/doc\/html\/rfc2865\"><span style=\"font-weight: 400;\">RFC 2865<\/span><\/a><span style=\"font-weight: 400;\">, was designed decades before modern credential-based attacks became the norm. Adding MFA on top of RADIUS today means inserting a second verification step between the network device and your directory \u2014 without replacing your existing infrastructure. Protectimus works as a RADIUS proxy: your Cisco firewall, Fortinet gateway, or Palo Alto firewall keeps talking RADIUS exactly as before, while a second factor is enforced at the proxy layer before a RADIUS Access-Accept is issued.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-cdef92e padded e-flex e-con-boxed e-con e-parent\" data-id=\"cdef92e\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-56c84d1 elementor-widget elementor-widget-heading\" data-id=\"56c84d1\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Key facts\n<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-bff780b elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"bff780b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-d391a8f e-grid e-con-boxed e-con e-child\" data-id=\"d391a8f\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-64a96a2 border-left e-flex e-con-boxed e-con e-child\" data-id=\"64a96a2\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-4dfef98 elementor-widget elementor-widget-heading\" data-id=\"4dfef98\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Credentials are the #1 attack vector<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0cc1bea elementor-widget elementor-widget-heading\" data-id=\"0cc1bea\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-heading-title elementor-size-default\">FACT<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f5e29e2 elementor-widget elementor-widget-text-editor\" data-id=\"f5e29e2\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Credential-based attacks \u2014 including phishing, credential stuffing, and password spraying \u2014 consistently rank among the top initial access vectors for network breaches, with VPN endpoints being a primary target.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-f5947b8 border-left e-flex e-con-boxed e-con e-child\" data-id=\"f5947b8\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-fa74c1f elementor-hidden-desktop elementor-hidden-tablet elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"fa74c1f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-47e43b7 elementor-widget elementor-widget-heading\" data-id=\"47e43b7\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">AAL2 mandates MFA<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fb629a4 elementor-widget elementor-widget-heading\" data-id=\"fb629a4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-heading-title elementor-size-default\">NIST<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c6c866e elementor-hidden-desktop elementor-hidden-tablet elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"c6c866e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8085769 elementor-widget elementor-widget-text-editor\" data-id=\"8085769\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">NIST SP 800-63B Authenticator Assurance Level 2 (AAL2) explicitly requires multi-factor authentication for any network access to sensitive systems. <\/span><\/p><p><span style=\"font-weight: 400;\">(<a target=\"_blank\" target=\"_blank\" href=\"https:\/\/pages.nist.gov\/800-63-3\/sp800-63b.html\">NIST Special Publication 800-63B<\/a>)<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-5c0d1fa border-left e-flex e-con-boxed e-con e-child\" data-id=\"5c0d1fa\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-d45db87 elementor-widget elementor-widget-heading\" data-id=\"d45db87\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">VPN infrastructure is under attack<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-344d455 elementor-widget elementor-widget-heading\" data-id=\"344d455\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-heading-title elementor-size-default\">CISA<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3a4d317 elementor-widget elementor-widget-text-editor\" data-id=\"3a4d317\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">CISA&#8217;s advisory on VPN security notes that attackers routinely target remote access infrastructure specifically because it often lacks a second authentication factor. <\/span><\/p><p><span style=\"font-weight: 400;\">(<a target=\"_blank\" target=\"_blank\" href=\"https:\/\/www.cisa.gov\/news-events\/cybersecurity-advisories\/aa23-025a\">CISA&#8217;s advisories<\/a>)<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-0ae1e9a padded e-flex e-con-boxed e-con e-parent\" data-id=\"0ae1e9a\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-e899921 elementor-widget elementor-widget-heading\" data-id=\"e899921\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Key Takeaways<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-86d1b8b elementor-widget elementor-widget-spacer\" data-id=\"86d1b8b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-9d5e935 e-grid e-con-full e-con e-child\" data-id=\"9d5e935\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-12e9470 e-con-full e-flex e-con e-child\" data-id=\"12e9470\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-8644d62 elementor-widget elementor-widget-image\" data-id=\"8644d62\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" width=\"56\" height=\"60\" src=\"https:\/\/www.protectimus.com\/wp-content\/uploads\/2026\/05\/radius1.svg\" class=\"attachment-full size-full wp-image-16523\" alt=\"RADOIS MFA icon\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-317cba7 elementor-widget elementor-widget-heading\" data-id=\"317cba7\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">No infrastructure changes required<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d96a026 elementor-widget elementor-widget-text-editor\" data-id=\"d96a026\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Protectimus operates as a RADIUS proxy; your existing VPN gateways, wireless controllers, and network switches keep their configuration.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-68b5ae8 e-con-full e-flex e-con e-child\" data-id=\"68b5ae8\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-8b57400 elementor-widget elementor-widget-image\" data-id=\"8b57400\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" width=\"64\" height=\"64\" src=\"https:\/\/www.protectimus.com\/wp-content\/uploads\/2025\/03\/key-5.svg\" class=\"attachment-full size-full wp-image-12237\" alt=\"On-Premise MFA Platform \u2013 Security feature: Access Filters\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-767e2aa elementor-widget elementor-widget-heading\" data-id=\"767e2aa\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Fast deployment<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d73153e elementor-widget elementor-widget-text-editor\" data-id=\"d73153e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Many organizations can implement RADIUS MFA within a single business day, depending on infrastructure complexity and integration requirements.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-9d3b5b8 e-con-full e-flex e-con e-child\" data-id=\"9d3b5b8\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-89d54f8 elementor-widget elementor-widget-image\" data-id=\"89d54f8\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" width=\"28\" height=\"28\" src=\"https:\/\/www.protectimus.com\/wp-content\/uploads\/2024\/03\/icon-radius.svg\" class=\"attachment-full size-full wp-image-12517\" alt=\"MFA for RADIUS icon\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f7f585d elementor-widget elementor-widget-heading\" data-id=\"f7f585d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Vendor-agnostic<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-aff0db8 elementor-widget elementor-widget-text-editor\" data-id=\"aff0db8\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Tested and documented integrations with Cisco ASA\/FTD, Juniper, Fortinet FortiGate, Palo Alto GlobalProtect, SonicWall, Check Point, F5, and many other platforms.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-9ddacc7 e-con-full e-flex e-con e-child\" data-id=\"9ddacc7\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-82d1654 elementor-widget elementor-widget-image\" data-id=\"82d1654\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"56\" height=\"56\" src=\"https:\/\/www.protectimus.com\/wp-content\/uploads\/2024\/02\/icon-windows.svg\" class=\"attachment-full size-full wp-image-14555\" alt=\"MFA for Windows and RDP - icon\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-eb78c60 elementor-widget elementor-widget-heading\" data-id=\"eb78c60\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Full AD\/LDAP sync<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ee318b2 elementor-widget elementor-widget-text-editor\" data-id=\"ee318b2\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>User provisioning, group policies, and directory lookups all pull from your existing Active Directory or LDAP.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-cb9fab9 e-con-full e-flex e-con e-child\" data-id=\"cb9fab9\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-1b3c387 elementor-widget elementor-widget-image\" data-id=\"1b3c387\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"57\" height=\"56\" src=\"https:\/\/www.protectimus.com\/wp-content\/uploads\/2026\/05\/plat_new.svg\" class=\"attachment-full size-full wp-image-16520\" alt=\"On-premise MFA platform icon\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-84c6048 elementor-widget elementor-widget-heading\" data-id=\"84c6048\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">On-premises or cloud<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1abcc56 elementor-widget elementor-widget-text-editor\" data-id=\"1abcc56\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Deployment options are available, allowing organizations to choose the architecture that best fits their security and operational requirements.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-7c15682 e-con-full e-flex e-con e-child\" data-id=\"7c15682\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-ffb514c elementor-widget elementor-widget-image\" data-id=\"ffb514c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"57\" height=\"57\" src=\"https:\/\/www.protectimus.com\/wp-content\/uploads\/2026\/05\/vpn2.svg\" class=\"attachment-full size-full wp-image-16526\" alt=\"VPN MFA icon\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3382fca elementor-widget elementor-widget-heading\" data-id=\"3382fca\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Designed for VPN<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-785b26a elementor-widget elementor-widget-text-editor\" data-id=\"785b26a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">and other RADIUS-based remote access scenarios.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-30a9584 elementor-widget elementor-widget-spacer\" data-id=\"30a9584\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-5b50e5c padded e-flex e-con-boxed e-con e-parent\" data-id=\"5b50e5c\" data-element_type=\"container\" data-e-type=\"container\" id=\"what-is-radius\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-28b1e56 e-con-full e-flex e-con e-child\" data-id=\"28b1e56\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-a6f90e4 elementor-widget elementor-widget-heading\" data-id=\"a6f90e4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What Is RADIUS Authentication and Why It Needs MFA<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9d2498b elementor-widget elementor-widget-text-editor\" data-id=\"9d2498b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>RADIUS is a client\/server protocol that centralizes authentication, authorization, and accounting (AAA) for network access. When a user connects to a VPN, authenticates to corporate Wi-Fi, or logs into a switch over a management interface, the network device (called the NAS \u2014 Network Access Server) sends an <strong>Access-Request<\/strong> packet to the RADIUS server. That server validates the credentials and replies with one of three messages: <strong>Access-Accept<\/strong> (let them in), <strong>Access-Reject<\/strong> (deny), or <strong>Access-Challenge<\/strong> (request additional information, such as an OTP).<\/p><p>It&#8217;s a tidy, battle-tested protocol. But its original design assumed that a valid username\/password combination was sufficient proof of identity. In 2026, that assumption is untenable.<\/p><p>\u00a0<\/p><h3><span style=\"font-weight: 400;\">Why passwords alone don&#8217;t protect RADIUS-authenticated services<\/span><\/h3><p><b>Credential stuffing<\/b><span style=\"font-weight: 400;\"> is the attack that keeps network security teams up at night. Attackers buy or scrape lists of leaked username\/password pairs \u2014 billions of them are freely traded on criminal forums \u2014 and automate login attempts against VPN endpoints. Most VPN gateways don&#8217;t have lockout policies tight enough to stop low-and-slow attacks. Even a 0.5% success rate against a 50,000-credential list hands attackers 250 valid VPN sessions.<\/span><\/p><p><b>Password spraying<\/b><span style=\"font-weight: 400;\"> is the quieter variant: instead of hammering one account, attackers try one common password (<em>like <\/em><\/span><em><span style=\"font-weight: 400;\">Autumn2024!<\/span><\/em><span style=\"font-weight: 400;\">) across thousands of accounts. It bypasses most account lockout thresholds and is nearly invisible in logs.<\/span><\/p><p><span style=\"font-weight: 400;\">Beyond spray-and-pray, targeted attackers use phishing to harvest domain credentials, then pivot directly to VPN or Wi-Fi access \u2014 completely bypassing perimeter defenses.<\/span><\/p><p><span style=\"font-weight: 400;\">RADIUS itself has no mechanism to enforce a second factor. It passes credentials to a backend directory, gets Accept\/Reject back, and that&#8217;s the end of the conversation. One common way to add MFA to RADIUS is to deploy a RADIUS proxy that intercepts the Access-Request, validates the password upstream, and then enforces an OTP challenge before issuing an Access-Accept.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-d57877c padded e-flex e-con-boxed e-con e-parent\" data-id=\"d57877c\" data-element_type=\"container\" data-e-type=\"container\" id=\"how-protectimus-adds-mfa\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-1698709 e-con-full e-flex e-con e-child\" data-id=\"1698709\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-88c2197 elementor-widget elementor-widget-heading\" data-id=\"88c2197\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How Protectimus Adds MFA to RADIUS Authentication<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-83f93dd elementor-widget elementor-widget-text-editor\" data-id=\"83f93dd\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<span style=\"font-weight: 400;\">The architecture is deliberately simple. Protectimus RADIUS Server sits between your network device and your existing RADIUS\/AD backend as a <\/span><b>RADIUS proxy<\/b><span style=\"font-weight: 400;\">. The network device doesn&#8217;t know anything changed; it just sends its Access-Request to a different IP address. From the AD side, the Protectimus server authenticates against the directory using the user&#8217;s password exactly as it always did.<\/span>\n<br><br>\n<h3>Authentication flow<\/h3>\n<div style=\"max-width:620px;margin:30px 0;font-family:Arial,sans-serif;\">\n\n<div>\n\n<div style=\"width:460px;box-sizing:border-box;padding:16px 20px;border:1px solid #111111;background:linear-gradient(135deg,rgba(123,225,255,.35) 0%,rgba(123,225,255,.18) 45%,rgba(123,225,255,0) 100%);text-align:center;\">\n<strong>User<\/strong><br>\n<small>VPN \/ Wi-Fi Client<\/small>\n<\/div>\n\n<div style=\"width:460px;text-align:center;margin:8px 0;\">\n<small style=\"color:#666;\">Access-Request (username + password)<\/small>\n<div style=\"width:2px;height:18px;background:#111;margin:4px auto 0;\"><\/div>\n<div style=\"font-size:13px;line-height:10px;\">\u25bc<\/div>\n<\/div>\n\n<div style=\"width:460px;box-sizing:border-box;padding:16px 20px;border:1px solid #111111;background:linear-gradient(135deg,rgba(123,225,255,.35) 0%,rgba(123,225,255,.18) 45%,rgba(123,225,255,0) 100%);text-align:center;\">\n<strong>Network Device<\/strong><br>\n<small>Cisco ASA \/ FortiGate \/ UniFi \/ etc.<\/small>\n<\/div>\n\n<div style=\"width:460px;text-align:center;margin:8px 0;\">\n<small style=\"color:#666;\">RADIUS Access-Request<\/small>\n<div style=\"width:2px;height:18px;background:#111;margin:4px auto 0;\"><\/div>\n<div style=\"font-size:13px;line-height:10px;\">\u25bc<\/div>\n<\/div>\n\n<div style=\"width:460px;box-sizing:border-box;padding:16px 20px;border:1px solid #111111;background:linear-gradient(135deg,rgba(123,225,255,.35) 0%,rgba(123,225,255,.18) 45%,rgba(123,225,255,0) 100%);text-align:center;\">\n<strong>Protectimus RADIUS Server<\/strong><br>\n<small>Validate password via AD \/ LDAP<\/small><br><br>\n<small><strong>Returns Access-Challenge (OTP)<\/strong><\/small>\n<\/div>\n\n<div style=\"width:460px;text-align:center;margin:8px 0;\">\n<small style=\"color:#666;\">User enters OTP<\/small>\n<div style=\"width:2px;height:18px;background:#111;margin:4px auto 0;\"><\/div>\n<div style=\"font-size:13px;line-height:10px;\">\u25bc<\/div>\n<\/div>\n\n<div style=\"width:460px;box-sizing:border-box;padding:16px 20px;border:1px solid #111111;background:linear-gradient(135deg,rgba(123,225,255,.35) 0%,rgba(123,225,255,.18) 45%,rgba(123,225,255,0) 100%);text-align:center;\">\n<strong>Protectimus RADIUS Server<\/strong><br>\n<small>Validate OTP<\/small><br><br>\n<small><strong>Returns Access-Accept<\/strong><\/small>\n<\/div>\n\n<div style=\"width:460px;text-align:center;margin:8px 0;\">\n<div style=\"width:2px;height:18px;background:#111;margin:0 auto;\"><\/div>\n<div style=\"font-size:13px;line-height:10px;\">\u25bc<\/div>\n<\/div>\n\n<div style=\"width:460px;box-sizing:border-box;padding:16px 20px;border:1px solid #111111;background:linear-gradient(135deg,rgba(123,225,255,.60) 0%,rgba(123,225,255,.38) 45%,rgba(123,225,255,.08) 100%);text-align:center;\">\n<strong>Network Device<\/strong><br>\n<small>User session established<\/small>\n<\/div>\n\n<\/div>\n\n<\/div>\n<br>\n<p><b>Step 1 \u2014 Credential check.<\/b> Protectimus forwards the user&#8217;s password to Active Directory or LDAP for primary authentication. If the password fails, the request is rejected immediately. No MFA prompt is issued for failed passwords \u2014 this prevents enumeration attacks.<\/p>\n\n<p><b>Step 2 \u2014 MFA challenge.<\/b> After a successful password check, Protectimus sends an Access-Challenge back to the network device with a prompt for the second factor. The user enters their TOTP code from the MFA app, hardware OTP token, or chatbot\/SMS\/email OTP.<\/p>\n\n<p><b>Step 3 \u2014 Accept or reject.<\/b> If the second factor validates, an Access-Accept is issued. If not, Access-Reject. The network device enforces the result.<\/p>\n\n<p>One important technical note: the Access-Challenge flow requires the NAS device to support RADIUS challenge\/response. Most modern VPN clients (Cisco AnyConnect, Fortinet SSL VPN, Palo Alto GlobalProtect) handle this natively. For devices that do not support RADIUS Access-Challenge, Protectimus supports Inline Mode. In this mode, users enter their password and OTP in a single field using a configurable separator (for example, password,otp). This approach allows MFA enforcement even on legacy systems that only support a single authentication exchange.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-86abc7e padded e-flex e-con-boxed e-con e-parent\" data-id=\"86abc7e\" data-element_type=\"container\" data-e-type=\"container\" id=\"supported-mfa-methods\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-f0f2e30 e-con-full e-flex e-con e-child\" data-id=\"f0f2e30\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-684bcff elementor-widget elementor-widget-heading\" data-id=\"684bcff\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Supported MFA Methods for RADIUS<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4b52e3d elementor-widget elementor-widget-text-editor\" data-id=\"4b52e3d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Different network access scenarios call for different second-factor methods. A VPN tunnel client has no browser UI. A corporate Wi-Fi 802.1X supplicant has even less. The table below maps methods to scenarios.<\/span><\/p><p>\u00a0<\/p><table><thead><tr><th><b>Method<\/b><\/th><th><b>How it works<\/b><\/th><th><b>Best for<\/b><\/th><th><b>Notes<\/b><\/th><\/tr><\/thead><tbody><tr><td><a href=\"https:\/\/www.protectimus.com\/ru\/token\/smart\/\"><b>Authenticator app (TOTP)<\/b><\/a><\/td><td><span style=\"font-weight: 400;\">30-second rotating code from an authenticator app<\/span><\/td><td><span style=\"font-weight: 400;\">VPN and other supported RADIUS-protected services<\/span><\/td><td><span style=\"font-weight: 400;\">Works with virtually any RADIUS client; no internet required after enrollment<\/span><\/td><\/tr><tr><td><a href=\"https:\/\/www.protectimus.com\/ru\/tokens\/\"><b>Hardware tokens (TOTP)<\/b><\/a><\/td><td><span style=\"font-weight: 400;\">30-second rotating code from a physical TOTP device<\/span><\/td><td><span style=\"font-weight: 400;\">Air-gapped environments, users without smartphones<\/span><\/td><td><span style=\"font-weight: 400;\">Supports Protectimus Two, Slim NFC, Flex, Shark, and OATH-compatible third-party tokens<\/span><\/td><\/tr><tr><td><a href=\"https:\/\/www.protectimus.com\/ru\/token\/sms\/\"><b>SMS OTP<\/b><\/a><\/td><td><span style=\"font-weight: 400;\">6-digit code sent via SMS<\/span><\/td><td><span style=\"font-weight: 400;\">VPN and other supported RADIUS-protected services<\/span><\/td><td><span style=\"font-weight: 400;\">Requires mobile signal; works with Inline Mode<\/span><\/td><\/tr><tr><td><a href=\"https:\/\/www.protectimus.com\/ru\/token\/mail\/\"><b>Email OTP<\/b><\/a><\/td><td><span style=\"font-weight: 400;\">6-digit code sent to email<\/span><\/td><td><span style=\"font-weight: 400;\">VPN and other supported RADIUS-protected services<\/span><\/td><td><span style=\"font-weight: 400;\">Suitable where SMS isn&#8217;t available<\/span><\/td><\/tr><tr><td><a href=\"https:\/\/www.protectimus.com\/ru\/token\/bot\/\"><b>Chatbot OTP<\/b><\/a><\/td><td><span style=\"font-weight: 400;\">OTP delivered through Telegram, Viber, or Facebook Messenger<\/span><\/td><td><span style=\"font-weight: 400;\">VPN and other supported RADIUS-protected services<\/span><\/td><td><span style=\"font-weight: 400;\">No SMS costs or mobile carrier dependency<\/span><\/td><\/tr><\/tbody><\/table><p>\u00a0<\/p><p><b>For VPN specifically:<\/b><span style=\"font-weight: 400;\"> TOTP (via app or hardware token) and chatbot\/SMS\/email OTP work in both challenge\/response mode and Inline Mode.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-280411b padded e-flex e-con-boxed e-con e-parent\" data-id=\"280411b\" data-element_type=\"container\" data-e-type=\"container\" id=\"supported-radius-equip\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-2bd5d59 e-con-full e-flex e-con e-child\" data-id=\"2bd5d59\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-347cae5 elementor-widget elementor-widget-heading\" data-id=\"347cae5\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Supported RADIUS Clients &amp; Network Equipment<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3977085 elementor-widget elementor-widget-text-editor\" data-id=\"3977085\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Protectimus has documented integrations and has been tested with the following network equipment. The full <\/span><a href=\"https:\/\/www.protectimus.com\/ru\/guides\/radius-2fa\/\"><span style=\"font-weight: 400;\">RADIUS MFA integration guide<\/span><\/a><span style=\"font-weight: 400;\"> includes step-by-step configuration for each.<\/span><\/p><p>\u00a0<\/p><table><thead><tr><th><p><b>Vendor<\/b><\/p><\/th><th><p><b>Product \/ Feature<\/b><\/p><\/th><th><p><b>Access Type<\/b><\/p><\/th><\/tr><\/thead><tbody><tr><td><p><span style=\"font-weight: 400;\">Cisco<\/span><\/p><\/td><td><p><a href=\"https:\/\/www.protectimus.com\/ru\/guides\/cisco-anyconnect\/\"><span style=\"font-weight: 400;\">ASA, FTD, AnyConnect VPN<\/span><\/a><\/p><\/td><td><p><span style=\"font-weight: 400;\">VPN<\/span><\/p><\/td><\/tr><tr><td><p><span style=\"font-weight: 400;\">Cisco<\/span><\/p><\/td><td><p><a href=\"https:\/\/www.protectimus.com\/ru\/guides\/cisco-switches-2fa\/\"><span style=\"font-weight: 400;\">Catalyst switches (AAA login)<\/span><\/a><\/p><\/td><td><p><span style=\"font-weight: 400;\">Administrative access<\/span><\/p><\/td><\/tr><tr><td><p><span style=\"font-weight: 400;\">Juniper<\/span><\/p><\/td><td><p><a href=\"https:\/\/www.protectimus.com\/ru\/guides\/juniper-vpn-2fa\/\"><span style=\"font-weight: 400;\">SRX, Pulse Connect Secure<\/span><\/a><\/p><\/td><td><p><span style=\"font-weight: 400;\">VPN<\/span><\/p><\/td><\/tr><tr><td><p><span style=\"font-weight: 400;\">Fortinet<\/span><\/p><\/td><td><p><a href=\"https:\/\/www.protectimus.com\/ru\/guides\/fortigate-vpn-2fa\/\"><span style=\"font-weight: 400;\">FortiGate SSL VPN<\/span><\/a><\/p><\/td><td><p><span style=\"font-weight: 400;\">VPN<\/span><\/p><\/td><\/tr><tr><td><p><span style=\"font-weight: 400;\">Palo Alto<\/span><\/p><\/td><td><p><a href=\"https:\/\/www.protectimus.com\/ru\/guides\/palo-alto-globalprotect-vpn-2fa\/\"><span style=\"font-weight: 400;\">GlobalProtect VPN<\/span><\/a><\/p><\/td><td><p><span style=\"font-weight: 400;\">VPN<\/span><\/p><\/td><\/tr><tr><td><p><span style=\"font-weight: 400;\">SonicWall<\/span><\/p><\/td><td><p><a href=\"https:\/\/www.protectimus.com\/ru\/guides\/sonicwall-vpn-2fa\/\"><span style=\"font-weight: 400;\">NetExtender, Mobile Connect<\/span><\/a><\/p><\/td><td><p><span style=\"font-weight: 400;\">VPN<\/span><\/p><\/td><\/tr><tr><td><p><span style=\"font-weight: 400;\">Check Point<\/span><\/p><\/td><td><p><a href=\"https:\/\/www.protectimus.com\/ru\/guides\/check-point-vpn-2fa\/\"><span style=\"font-weight: 400;\">Mobile Access blade<\/span><\/a><\/p><\/td><td><p><span style=\"font-weight: 400;\">VPN<\/span><\/p><\/td><\/tr><tr><td><p><span style=\"font-weight: 400;\">F5<\/span><\/p><\/td><td><p><a href=\"https:\/\/www.protectimus.com\/ru\/guides\/f5-big-ip-apm-vpn-2fa\/\"><span style=\"font-weight: 400;\">APM (Access Policy Manager)<\/span><\/a><\/p><\/td><td><p><span style=\"font-weight: 400;\">VPN \/ App proxy<\/span><\/p><\/td><\/tr><tr><td><p><span style=\"font-weight: 400;\">Citrix<\/span><\/p><\/td><td><p><a href=\"https:\/\/www.protectimus.com\/ru\/guides\/citrix-adc-and-gateway\/\"><span style=\"font-weight: 400;\">ADC (NetScaler)<\/span><\/a><\/p><\/td><td><p><span style=\"font-weight: 400;\">VPN \/ App proxy<\/span><\/p><\/td><\/tr><tr><td><p><span style=\"font-weight: 400;\">Ubiquiti<\/span><\/p><\/td><td><p><a href=\"https:\/\/www.protectimus.com\/ru\/guides\/ubiquiti-unifi-controller-sms-authentication\/\"><span style=\"font-weight: 400;\">UniFi Controller (Guest Portal)<\/span><\/a><\/p><\/td><td><p><span style=\"font-weight: 400;\">Guest Wi-Fi<\/span><\/p><\/td><\/tr><tr><td><p><span style=\"font-weight: 400;\">Array Networks<\/span><\/p><\/td><td><p><a href=\"https:\/\/www.protectimus.com\/ru\/guides\/array-ag-ssl-vpn-2fa\/\"><span style=\"font-weight: 400;\">AG Series SSL VPN<\/span><\/a><\/p><\/td><td><p><span style=\"font-weight: 400;\">VPN<\/span><\/p><\/td><\/tr><\/tbody><\/table><p>\u00a0<\/p><p><b>This list covers the most common deployments. Any device that sends standard RFC 2865 RADIUS requests will work, even if it isn&#8217;t listed here.<\/b><\/p><p><b>Note: <\/b><span style=\"font-weight: 400;\">Some RADIUS-based deployments are not yet included in our documented integrations. Because Protectimus operates as a standards-based RADIUS proxy, additional RADIUS architectures \u2014 including deployments based on FreeRADIUS or Microsoft NPS \u2014 may also be compatible. If you are planning one of these deployments, please contact our team to discuss your specific environment.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-a29b829 padded e-flex e-con-boxed e-con e-parent\" data-id=\"a29b829\" data-element_type=\"container\" data-e-type=\"container\" id=\"radius-mfa-for-vpn\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-1dc9ec2 e-con-full e-flex e-con e-child\" data-id=\"1dc9ec2\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-131348d elementor-widget elementor-widget-heading\" data-id=\"131348d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">RADIUS MFA for VPN<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5266633 elementor-widget elementor-widget-text-editor\" data-id=\"5266633\" data-element_type=\"widget\" data-e-type=\"widget\" id=\"supported-mfa-methods\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">VPN is by far the most common RADIUS MFA deployment, and it&#8217;s also the most security-critical one. A compromised VPN session gives an attacker the same network position as a legitimate remote employee \u2014 with access to file shares, internal web apps, databases, and lateral movement paths.<\/span><\/p><p>\u00a0<\/p><h3><span style=\"font-weight: 400;\">How MFA works over VPN (without a browser)<\/span><\/h3><p><span style=\"font-weight: 400;\">When a user connects via Cisco AnyConnect or Fortinet&#8217;s SSL VPN client, the connection is initiated at the OS or client-app level. There&#8217;s no browser, no JavaScript, no redirect URI. The VPN client sends credentials directly to the NAS, which forwards them as a RADIUS Access-Request.<\/span><\/p><p><span style=\"font-weight: 400;\">With challenge\/response support enabled in the VPN client, the flow works exactly as described in the architecture section: the user sees a secondary prompt (&#171;Enter your OTP&#187;) in the VPN client UI after entering their password. Most modern VPN clients render this field correctly, and users find it intuitive.<\/span><\/p><p><span style=\"font-weight: 400;\">For legacy VPN clients that do not support RADIUS Access-Challenge, Protectimus provides Inline Mode. Users enter their password and OTP in a single authentication field using a configured separator. This allows organizations to deploy MFA without replacing existing VPN infrastructure.<\/span><\/p><p><span style=\"font-weight: 400;\">Ensure the VPN gateway can always reach the Protectimus RADIUS server (UDP 1812\/1813 if accounting is used), regardless of the VPN routing configuration.<\/span><\/p><p><span style=\"font-weight: 400;\">See the full RADIUS MFA integration guide and <\/span><a href=\"https:\/\/www.protectimus.com\/ru\/mfa-for-cisco-anyconnect\/\"><span style=\"font-weight: 400;\">MFA for Cisco AnyConnect VPN<\/span><\/a><span style=\"font-weight: 400;\"> for vendor-specific configuration steps.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-16797b4 padded e-flex e-con-boxed e-con e-parent\" data-id=\"16797b4\" data-element_type=\"container\" data-e-type=\"container\" id=\"radius-mfa-for-wlan-access\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-bb86bc5 e-con-full e-flex e-con e-child\" data-id=\"bb86bc5\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-891beb3 elementor-widget elementor-widget-heading\" data-id=\"891beb3\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">RADIUS MFA for Wireless Network Access<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d7f6098 elementor-widget elementor-widget-text-editor\" data-id=\"d7f6098\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">While VPN is the most common RADIUS MFA deployment, organizations also use RADIUS to protect wireless network access. The exact authentication flow depends on the wireless infrastructure and authentication method in use.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Protectimus supports wireless access scenarios that integrate with <\/span><a href=\"https:\/\/www.protectimus.com\/ru\/wifi-sms-authentication\/\"><span style=\"font-weight: 400;\">RADIUS-based authentication<\/span><\/a><span style=\"font-weight: 400;\">, including guest Wi-Fi deployments such as the Ubiquiti UniFi Guest Portal. In these environments, users authenticate using a one-time password delivered via SMS, chatbot, email, or a TOTP generated by an authenticator app or hardware token, depending on the deployment.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">For guest Wi-Fi environments, Protectimus can be deployed either with the Protectimus Cloud Service or the Protectimus On-Premise Platform. Authentication requests are validated through the Protectimus platform before network access is granted, while administrators retain centralized logging and user management capabilities.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">When planning MFA for enterprise wireless networks, verify that your wireless infrastructure and authentication flow support the required RADIUS authentication method. Authentication capabilities may vary depending on the wireless controller, access gateway, or captive portal implementation.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-dd147b2 padded e-flex e-con-boxed e-con e-parent\" data-id=\"dd147b2\" data-element_type=\"container\" data-e-type=\"container\" id=\"deployment-opt\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-c9b7b25 e-con-full e-flex e-con e-child\" data-id=\"c9b7b25\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-fad9de1 elementor-widget elementor-widget-heading\" data-id=\"fad9de1\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Deployment Options<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-78865c0 elementor-widget elementor-widget-text-editor\" data-id=\"78865c0\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h3><span style=\"font-weight: 400;\">Cloud RADIUS MFA (SaaS)<\/span><\/h3><p><span style=\"font-weight: 400;\">The Protectimus RADIUS Server is installed inside your network and configured to communicate with the Protectimus Cloud Service. Your network devices send RADIUS authentication requests to the local Protectimus RADIUS Server, which validates the user&#8217;s primary credentials against your Active Directory or LDAP and verifies the second factor through the Protectimus Cloud Service. No on-premises MFA platform is required, making this deployment suitable for organizations that want fast deployment and minimal infrastructure.<\/span><\/p><p>\u00a0<\/p><h3><span style=\"font-weight: 400;\">On-Premises RADIUS MFA Server<\/span><\/h3><p><span style=\"font-weight: 400;\">The Protectimus RADIUS Server and Protectimus On-Premise Platform are installed on standard Windows Server or Linux hosts inside your network. The RADIUS Server validates primary credentials against Active Directory or LDAP and verifies the second factor using the local Protectimus Platform. All authentication requests remain within your infrastructure, making this deployment suitable for organizations with data residency requirements, air-gapped environments, or internal security policies that prohibit cloud authentication services.<\/span><\/p><p>\u00a0<\/p><h3><span style=\"font-weight: 400;\">High Availability Setup<\/span><\/h3><p><span style=\"font-weight: 400;\">In both deployment modes, Protectimus supports high-availability configurations. Organizations can deploy primary and secondary Protectimus RADIUS Server instances. Network devices can be configured with both server IPs using standard RADIUS failover (the secondary server is used if the primary doesn&#8217;t respond within the configured timeout period). Most enterprise firewalls, VPN gateways, and RADIUS clients support this natively.<\/span><\/p><p><span style=\"font-weight: 400;\">In Cloud deployments, redundant Protectimus RADIUS Server instances connect to the Protectimus Cloud Service. In On-Premise deployments, high availability can be extended to the Protectimus Platform itself by deploying it as a cluster behind a customer-managed load balancer. Organizations can also deploy components across separate locations to further reduce the risk of service interruption<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-a2442ac padded e-flex e-con-boxed e-con e-parent\" data-id=\"a2442ac\" data-element_type=\"container\" data-e-type=\"container\" id=\"system-requirements\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-d2891c1 e-con-full e-flex e-con e-child\" data-id=\"d2891c1\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-f2847f8 elementor-widget elementor-widget-heading\" data-id=\"f2847f8\" data-element_type=\"widget\" data-e-type=\"widget\" id=\"howtosetup\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">System Requirements &amp; Integration<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-32a2622 elementor-widget elementor-widget-text-editor\" data-id=\"32a2622\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<table><thead><tr><th><p><b>Component<\/b><\/p><\/th><th><p><b>Requirement<\/b><\/p><\/th><\/tr><\/thead><tbody><tr><td><p><b>Deployment options<\/b><\/p><\/td><td><p><span style=\"font-weight: 400;\">Windows, Linux, Docker<\/span><\/p><\/td><\/tr><tr><td><p><b>RADIUS ports<\/b><\/p><\/td><td><p><span style=\"font-weight: 400;\">UDP 1812 (authentication), UDP 1813 (accounting)<\/span><\/p><\/td><\/tr><tr><td><p><b>IP protocol<\/b><\/p><\/td><td><p><span style=\"font-weight: 400;\">IPv4 and IPv6 supported<\/span><\/p><\/td><\/tr><tr><td><p><b>Directory integration<\/b><\/p><\/td><td><p><span style=\"font-weight: 400;\">Active Directory and LDAP directories<\/span><\/p><\/td><\/tr><tr><td><p><b>Network devices<\/b><\/p><\/td><td><p><span style=\"font-weight: 400;\">Any RFC 2865-compliant RADIUS client<\/span><\/p><\/td><\/tr><tr><td><p><b>Java<\/b><\/p><\/td><td><p><span style=\"font-weight: 400;\">Java is required for Windows installations. If Java is not already installed, the installer can install it automatically. Refer to current Protectimus documentation for supported versions.<\/span><\/p><\/td><\/tr><tr><td><p><b>Firewall rules<\/b><\/p><\/td><td><p><span style=\"font-weight: 400;\">UDP 1812 open between RADIUS clients and the Protectimus RADIUS Server; LDAP\/LDAPS (389\/636) access from the Protectimus RADIUS Server to Active Directory or LDAP, if used for primary authentication.<\/span><\/p><\/td><\/tr><\/tbody><\/table>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-41f9125 padded e-flex e-con-boxed e-con e-parent\" data-id=\"41f9125\" data-element_type=\"container\" data-e-type=\"container\" id=\"radius-setup\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-58d168e e-con-full e-flex e-con e-child\" data-id=\"58d168e\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-f023dfa elementor-widget elementor-widget-heading\" data-id=\"f023dfa\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Step-by-Step: How to Set Up RADIUS MFA in 5 Steps<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9d798bf elementor-widget elementor-widget-text-editor\" data-id=\"9d798bf\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><b>Step 1 \u2014 Deploy the Protectimus RADIUS Server.<\/b><span style=\"font-weight: 400;\"> Choose Cloud or On-Premise deployment. For Cloud, create an account at service.protectimus.com, activate API access, and install the Protectimus RADIUS Server inside your network. For On-Premise, download the installer package, run it on your target Windows or Linux server, and install both the Protectimus RADIUS Server and the Protectimus On-Premise Platform.<\/span><\/p>\n<p><b>Step 2 \u2014 Configure your AD\/LDAP connection.<\/b><span style=\"font-weight: 400;\"> In the Protectimus RADIUS Server configuration file, add your domain controller address, bind account, search base, and authentication provider settings. Test the connection to confirm that the Protectimus RADIUS Server can communicate with your directory service.<\/span><\/p>\n<p><b>Step 3 \u2014 Add your network device as a RADIUS client.<\/b><span style=\"font-weight: 400;\"> In the Protectimus RADIUS Server configuration, register the IP address and shared secret for each NAS device, such as your VPN gateway, firewall, or other supported network device. This is the same shared secret you&#8217;ll configure on the device side.<\/span><\/p>\n<p><b>Step 4 \u2014 Point the network device to Protectimus.<\/b><span style=\"font-weight: 400;\"> On your Cisco ASA, Fortinet, Palo Alto, or other supported device, change the RADIUS server IP to the Protectimus RADIUS Server. Set the shared secret to match what you configured in Step 3 and configure UDP port 1812 for RADIUS authentication.<\/span><\/p>\n<p><b>Step 5 \u2014 Enroll users and test.<\/b><span style=\"font-weight: 400;\"> Enroll a pilot group of users\u2014either by sending them a self-enrollment link or by bulk-importing via an AD group. Have them scan a QR code in their authenticator app or assign hardware tokens. Test the complete authentication flow using your RADIUS-protected service: enter credentials, complete the OTP challenge, and confirm that access is granted after a valid code.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">For the full technical walkthrough with vendor-specific screenshots, see the <\/span><a href=\"https:\/\/www.protectimus.com\/ru\/guides\/radius-2fa\/\"><span style=\"font-weight: 400;\">full RADIUS MFA integration guide<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/p>\n<p>\u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-70d012a padded e-flex e-con-boxed e-con e-parent\" data-id=\"70d012a\" data-element_type=\"container\" data-e-type=\"container\" id=\"radius-mfa-compliance\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-af82edd e-con-full e-flex e-con e-child\" data-id=\"af82edd\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-a4316cb elementor-widget elementor-widget-heading\" data-id=\"a4316cb\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Compliance: How RADIUS MFA Satisfies Regulatory Requirements<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-801b04d elementor-widget elementor-widget-text-editor\" data-id=\"801b04d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h3><span style=\"font-weight: 400;\">NIST SP 800-63B (AAL2)<\/span><\/h3><p><span style=\"font-weight: 400;\">NIST&#8217;s digital identity guidelines define three Authenticator Assurance Levels. AAL2 requires two distinct authentication factors for access to sensitive systems. RADIUS MFA with TOTP or hardware tokens meets AAL2 requirements directly \u2014 the password is the memorized secret (something you know), and the TOTP code is generated by a bound authenticator (something you have).<\/span><\/p><p>\u00a0<\/p><h3><span style=\"font-weight: 400;\">PCI DSS v4.0 \u2014 Requirement 8.4<\/span><\/h3><p><span style=\"font-weight: 400;\">PCI DSS v4.0 Requirement 8.4.2 mandates MFA for all access into the cardholder data environment \u2014 for any user, regardless of whether they&#8217;re connecting remotely or from inside the network. Requirement 8.4.3 narrows in on remote access specifically: MFA is required for all remote network access to the CDE originating from outside the organization&#8217;s network, covering employees, contractors, and third-party vendors alike. RADIUS MFA helps organizations satisfy both requirements by enforcing MFA for VPN and other RADIUS-protected access to systems within the cardholder data environment.<\/span><\/p><p>\u00a0<\/p><h3><span style=\"font-weight: 400;\">HIPAA \u2014 Access Controls (45 CFR \u00a7 164.312)<\/span><\/h3><p><span style=\"font-weight: 400;\">HIPAA&#8217;s Technical Safeguard for access control requires covered entities to implement procedures that grant access to electronic PHI only to authorized persons. RADIUS MFA directly addresses this by adding a second verification step to VPN and Wi-Fi access \u2014 the two paths most commonly used for remote access to clinical systems.<\/span><\/p><p>\u00a0<\/p><h3><span style=\"font-weight: 400;\">NIS2 Directive (EU) \u2014 Article 21<\/span><\/h3><p><span style=\"font-weight: 400;\">NIS2 requires essential and important entities to implement multi-factor authentication or continuous authentication solutions for access to network and information systems. RADIUS MFA satisfies this requirement for remote access scenarios, which are explicitly called out in ENISA&#8217;s implementation guidance.<\/span><\/p><p>\u00a0<\/p><h3><span style=\"font-weight: 400;\">ISO\/IEC 27001:2022 \u2014 Annex A 8.5<\/span><\/h3><p><span style=\"font-weight: 400;\">ISO 27001&#8217;s control on secure authentication explicitly recommends MFA for high-risk access scenarios, including remote access and privileged accounts. RADIUS MFA helps organizations implement this control for VPN and other RADIUS-protected services.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-a9cb282 padded e-flex e-con-boxed e-con e-parent\" data-id=\"a9cb282\" data-element_type=\"container\" data-e-type=\"container\" id=\"radius-mfa-faq\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-7659ffd elementor-widget elementor-widget-heading\" data-id=\"7659ffd\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">FAQ<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-dc81e4c e-con-full padded e-flex e-con e-child\" data-id=\"dc81e4c\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-fb2596d e-con-full faq-container e-flex e-con e-child\" data-id=\"fb2596d\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-412fa06 plus-right elementor-widget elementor-widget-n-accordion\" data-id=\"412fa06\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;default_state&quot;:&quot;all_collapsed&quot;,&quot;max_items_expended&quot;:&quot;one&quot;,&quot;n_accordion_animation_duration&quot;:{&quot;unit&quot;:&quot;ms&quot;,&quot;size&quot;:400,&quot;sizes&quot;:[]}}\" data-widget_type=\"nested-accordion.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"e-n-accordion\" aria-label=\"Accordion. Open links with Enter or Space, close with Escape, and navigate with Arrow Keys\">\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-6830\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"1\" tabindex=\"0\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-6830\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h3 class=\"e-n-accordion-item-title-text\"> Does Protectimus support RADIUS Access-Challenge for interactive OTP entry? <\/h3><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"24\" height=\"2\" viewBox=\"0 0 24 2\" fill=\"none\"><path d=\"M24 1L5.96046e-08 0.999999\" stroke=\"#111111\" stroke-width=\"2\"><\/path><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M12 0V24\" stroke=\"#111111\" stroke-width=\"2\"><\/path><path d=\"M24 12L5.96046e-08 12\" stroke=\"#111111\" stroke-width=\"2\"><\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-6830\" class=\"elementor-element elementor-element-ea1991a e-con-full e-flex e-con e-child\" data-id=\"ea1991a\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-8bad61c elementor-widget elementor-widget-text-editor\" data-id=\"8bad61c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Yes. Protectimus uses RADIUS Access-Challenge natively for interactive OTP prompts. When the NAS device supports challenge\/response (which most modern VPN clients do), users see a secondary input field for their OTP after entering their password. For devices that don&#8217;t support challenge\/response, Inline Mode is available as a fallback.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-6831\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"2\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-6831\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h3 class=\"e-n-accordion-item-title-text\"> Can I use Protectimus RADIUS MFA without replacing my existing RADIUS or NPS server? <\/h3><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"24\" height=\"2\" viewBox=\"0 0 24 2\" fill=\"none\"><path d=\"M24 1L5.96046e-08 0.999999\" stroke=\"#111111\" stroke-width=\"2\"><\/path><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M12 0V24\" stroke=\"#111111\" stroke-width=\"2\"><\/path><path d=\"M24 12L5.96046e-08 12\" stroke=\"#111111\" stroke-width=\"2\"><\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-6831\" class=\"elementor-element elementor-element-b2bdc68 e-con-full e-flex e-con e-child\" data-id=\"b2bdc68\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-f30747e elementor-widget elementor-widget-text-editor\" data-id=\"f30747e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Yes, and this is the most common deployment model. Protectimus operates as a RADIUS proxy upstream of your existing authentication server. Your NAS devices point to Protectimus; Protectimus handles MFA enforcement and then forwards the validated request onward. Your existing authentication policies, routing, and accounting configuration remain unchanged.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-6832\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"3\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-6832\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h3 class=\"e-n-accordion-item-title-text\"> What RADIUS authentication port does Protectimus use? <\/h3><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"24\" height=\"2\" viewBox=\"0 0 24 2\" fill=\"none\"><path d=\"M24 1L5.96046e-08 0.999999\" stroke=\"#111111\" stroke-width=\"2\"><\/path><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M12 0V24\" stroke=\"#111111\" stroke-width=\"2\"><\/path><path d=\"M24 12L5.96046e-08 12\" stroke=\"#111111\" stroke-width=\"2\"><\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-6832\" class=\"elementor-element elementor-element-0787040 e-con-full e-flex e-con e-child\" data-id=\"0787040\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-9eb7aff elementor-widget elementor-widget-text-editor\" data-id=\"9eb7aff\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Protectimus uses the standard RADIUS authentication port: UDP 1812. Accounting (if needed) uses UDP 1813. Both are configurable.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-6833\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"4\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-6833\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h3 class=\"e-n-accordion-item-title-text\"> How does MFA work over VPN when there is no browser interface? <\/h3><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"24\" height=\"2\" viewBox=\"0 0 24 2\" fill=\"none\"><path d=\"M24 1L5.96046e-08 0.999999\" stroke=\"#111111\" stroke-width=\"2\"><\/path><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M12 0V24\" stroke=\"#111111\" stroke-width=\"2\"><\/path><path d=\"M24 12L5.96046e-08 12\" stroke=\"#111111\" stroke-width=\"2\"><\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-6833\" class=\"elementor-element elementor-element-b3373c0 e-con-full e-flex e-con e-child\" data-id=\"b3373c0\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-6ef49d2 elementor-widget elementor-widget-text-editor\" data-id=\"6ef49d2\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Two modes are supported. In <\/span><b>challenge\/response mode<\/b><span style=\"font-weight: 400;\">, the VPN client displays a secondary prompt after the password is accepted \u2014 the user types their OTP in this field. In <\/span><b>Inline Mode<\/b><span style=\"font-weight: 400;\">, the user enters their password and OTP together in a single field using a configured separator. No browser is required in either case; the entire flow happens within the client&#8217;s native authentication interface.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-6834\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"5\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-6834\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h3 class=\"e-n-accordion-item-title-text\"> Does Protectimus RADIUS support high availability and failover? <\/h3><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"24\" height=\"2\" viewBox=\"0 0 24 2\" fill=\"none\"><path d=\"M24 1L5.96046e-08 0.999999\" stroke=\"#111111\" stroke-width=\"2\"><\/path><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M12 0V24\" stroke=\"#111111\" stroke-width=\"2\"><\/path><path d=\"M24 12L5.96046e-08 12\" stroke=\"#111111\" stroke-width=\"2\"><\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-6834\" class=\"elementor-element elementor-element-3e2c10e e-con-full e-flex e-con e-child\" data-id=\"3e2c10e\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-e1ee304 elementor-widget elementor-widget-text-editor\" data-id=\"e1ee304\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Yes. You can deploy multiple Protectimus RADIUS Server instances and configure your NAS devices with primary and secondary RADIUS targets. If the primary server doesn&#8217;t respond within the RADIUS timeout, the NAS retries against the secondary automatically. In On-Premise deployments, high availability can also be extended to the Protectimus Platform by deploying it as a cluster. Network devices automatically switch to the secondary server when the primary becomes unavailable, helping maintain authentication availability.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-6835\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"6\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-6835\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h3 class=\"e-n-accordion-item-title-text\"> Can I integrate Protectimus RADIUS with Active Directory? <\/h3><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"24\" height=\"2\" viewBox=\"0 0 24 2\" fill=\"none\"><path d=\"M24 1L5.96046e-08 0.999999\" stroke=\"#111111\" stroke-width=\"2\"><\/path><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M12 0V24\" stroke=\"#111111\" stroke-width=\"2\"><\/path><path d=\"M24 12L5.96046e-08 12\" stroke=\"#111111\" stroke-width=\"2\"><\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-6835\" class=\"elementor-element elementor-element-67bff32 e-con-full e-flex e-con e-child\" data-id=\"67bff32\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-ed5da62 elementor-widget elementor-widget-text-editor\" data-id=\"ed5da62\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Yes, and this is the default configuration for most enterprise deployments. Protectimus connects to your AD via LDAP or LDAPS (port 389\/636) and forwards password validation to the domain controller. Group-based policies are supported \u2014 you can require MFA for some AD groups and exempt others, or assign different MFA methods by group.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t<script type=\"application\/ld+json\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@type\":\"FAQPage\",\"mainEntity\":[{\"@type\":\"Question\",\"name\":\"Does Protectimus support RADIUS Access-Challenge for interactive OTP entry?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Yes. Protectimus uses RADIUS Access-Challenge natively for interactive OTP prompts. When the NAS device supports challenge\\\/response (which most modern VPN clients do), users see a secondary input field for their OTP after entering their password. For devices that don&#8217;t support challenge\\\/response, Inline Mode is available as a fallback.\"}},{\"@type\":\"Question\",\"name\":\"Can I use Protectimus RADIUS MFA without replacing my existing RADIUS or NPS server?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Yes, and this is the most common deployment model. Protectimus operates as a RADIUS proxy upstream of your existing authentication server. Your NAS devices point to Protectimus; Protectimus handles MFA enforcement and then forwards the validated request onward. Your existing authentication policies, routing, and accounting configuration remain unchanged.\"}},{\"@type\":\"Question\",\"name\":\"What RADIUS authentication port does Protectimus use?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Protectimus uses the standard RADIUS authentication port: UDP 1812. Accounting (if needed) uses UDP 1813. Both are configurable.\"}},{\"@type\":\"Question\",\"name\":\"How does MFA work over VPN when there is no browser interface?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Two modes are supported. In challenge\\\/response mode, the VPN client displays a secondary prompt after the password is accepted \\u2014 the user types their OTP in this field. In Inline Mode, the user enters their password and OTP together in a single field using a configured separator. No browser is required in either case; the entire flow happens within the client&#8217;s native authentication interface.\"}},{\"@type\":\"Question\",\"name\":\"Does Protectimus RADIUS support high availability and failover?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Yes. You can deploy multiple Protectimus RADIUS Server instances and configure your NAS devices with primary and secondary RADIUS targets. If the primary server doesn&#8217;t respond within the RADIUS timeout, the NAS retries against the secondary automatically. In On-Premise deployments, high availability can also be extended to the Protectimus Platform by deploying it as a cluster. Network devices automatically switch to the secondary server when the primary becomes unavailable, helping maintain authentication availability.\"}},{\"@type\":\"Question\",\"name\":\"Can I integrate Protectimus RADIUS with Active Directory?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Yes, and this is the default configuration for most enterprise deployments. Protectimus connects to your AD via LDAP or LDAPS (port 389\\\/636) and forwards password validation to the domain controller. Group-based policies are supported \\u2014 you can require MFA for some AD groups and exempt others, or assign different MFA methods by group.\"}}]}<\/script>\n\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7534fb4 elementor-widget elementor-widget-html\" data-id=\"7534fb4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"html.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<script type=\"application\/ld+json\">\r\n{\r\n  \"@context\": \"https:\/\/schema.org\",\r\n  \"@type\": \"HowTo\",\r\n  \"name\": \"How to Set Up RADIUS MFA in 5 Steps\",\r\n  \"description\": \"Add multi-factor authentication to any RADIUS-compatible VPN gateway, firewall, or network device using the Protectimus RADIUS Server, with cloud or on-premise deployment.\",\r\n  \"totalTime\": \"PT1H\",\r\n  \"tool\": [\r\n    {\r\n      \"@type\": \"HowToTool\",\r\n      \"name\": \"Protectimus RADIUS Server\"\r\n    },\r\n    {\r\n      \"@type\": \"HowToTool\",\r\n      \"name\": \"Protectimus Cloud Service or On-Premise Platform\"\r\n    },\r\n    {\r\n      \"@type\": \"HowToTool\",\r\n      \"name\": \"RADIUS-compatible network device (VPN gateway, firewall, Wi-Fi controller)\"\r\n    }\r\n  ],\r\n  \"step\": [\r\n    {\r\n      \"@type\": \"HowToStep\",\r\n      \"position\": 1,\r\n      \"name\": \"Deploy the Protectimus RADIUS Server\",\r\n      \"text\": \"Choose Cloud or On-Premise deployment. For Cloud, create an account at service.protectimus.com, activate API access, and install the Protectimus RADIUS Server inside your network. For On-Premise, download the installer package, run it on your target Windows or Linux server, and install both the Protectimus RADIUS Server and the Protectimus On-Premise Platform.\"\r\n    },\r\n    {\r\n      \"@type\": \"HowToStep\",\r\n      \"position\": 2,\r\n      \"name\": \"Configure your AD\/LDAP connection\",\r\n      \"text\": \"In the Protectimus RADIUS Server configuration file, add your domain controller address, bind account, search base, and authentication provider settings. Test the connection to confirm that the Protectimus RADIUS Server can communicate with your directory service.\"\r\n    },\r\n    {\r\n      \"@type\": \"HowToStep\",\r\n      \"position\": 3,\r\n      \"name\": \"Add your network device as a RADIUS client\",\r\n      \"text\": \"In the Protectimus RADIUS Server configuration, register the IP address and shared secret for each NAS device, such as your VPN gateway, firewall, or other supported network device. This is the same shared secret you'll configure on the device side.\"\r\n    },\r\n    {\r\n      \"@type\": \"HowToStep\",\r\n      \"position\": 4,\r\n      \"name\": \"Point the network device to Protectimus\",\r\n      \"text\": \"On your Cisco ASA, Fortinet, Palo Alto, or other supported device, change the RADIUS server IP to the Protectimus RADIUS Server. Set the shared secret to match what you configured in Step 3 and configure UDP port 1812 for RADIUS authentication.\"\r\n    },\r\n    {\r\n      \"@type\": \"HowToStep\",\r\n      \"position\": 5,\r\n      \"name\": \"Enroll users and test\",\r\n      \"text\": \"Enroll a pilot group of users \u2014 either by sending them a self-enrollment link or by bulk-importing via an AD group. Have them scan a QR code in their authenticator app or assign hardware tokens. Test the complete authentication flow using your RADIUS-protected service: enter credentials, complete the OTP challenge, and confirm that access is granted after a valid code.\"\r\n    }\r\n  ]\r\n}\r\n<\/script>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-fe2c5b0 padded e-flex e-con-boxed e-con e-parent\" data-id=\"fe2c5b0\" data-element_type=\"container\" data-e-type=\"container\" id=\"get-protected\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-e4ec716 e-con-full e-flex e-con e-child\" data-id=\"e4ec716\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-35746bf e-con-full e-flex e-con e-child\" data-id=\"35746bf\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-489bd70 e-con-full e-flex e-con e-child\" data-id=\"489bd70\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-10cf0aa elementor-widget elementor-widget-heading\" data-id=\"10cf0aa\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Start Securing Your Network Access Today<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6c0eeb4 elementor-widget elementor-widget-text-editor\" data-id=\"6c0eeb4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Every VPN endpoint, corporate Wi-Fi network, and <\/span><b>RADIUS-protected service<\/b><span style=\"font-weight: 400;\"> is a potential entry point. RADIUS MFA closes the credential-only gap without requiring changes to your existing network infrastructure.<\/span><\/p><ul><li style=\"font-weight: 400; text-align: left;\" aria-level=\"1\"><a href=\"https:\/\/www.protectimus.com\/ru\/platform\/\"><span style=\"font-weight: 400;\">Deploy on-premises \u2192 Protectimus On-Prem MFA Platform<\/span><\/a><\/li><li style=\"font-weight: 400; text-align: left;\" aria-level=\"1\"><a href=\"https:\/\/www.protectimus.com\/ru\/guides\/saas-service\/\"><span style=\"font-weight: 400;\">Use the cloud service \u2192 Protectimus SaaS Setup Guide<\/span><\/a><\/li><li style=\"font-weight: 400; text-align: left;\" aria-level=\"1\"><a href=\"https:\/\/www.protectimus.com\/ru\/guides\/radius-2fa\/\"><span style=\"font-weight: 400;\">Read the technical guide \u2192 Full RADIUS MFA Integration Guide<\/span><\/a><\/li><li style=\"font-weight: 400; text-align: left;\" aria-level=\"1\"><a href=\"https:\/\/www.protectimus.com\/ru\/tokens\/\"><span style=\"font-weight: 400;\">Hardware tokens for RADIUS MFA \u2192 Protectimus Tokens<\/span><\/a><\/li><li style=\"font-weight: 400; text-align: left;\" aria-level=\"1\"><a href=\"https:\/\/www.protectimus.com\/ru\/mfa-for-active-directory\/\"><span style=\"font-weight: 400;\">MFA for Active Directory \u2192 Agentless AD MFA Guide<\/span><\/a><\/li><li style=\"font-weight: 400; text-align: left;\" aria-level=\"1\"><a href=\"https:\/\/www.protectimus.com\/ru\/winlogon\/\"><span style=\"font-weight: 400;\">MFA for Windows Logon &amp; RDP \u2192 Winlogon Component<\/span><\/a><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-a3f81ec e-con-full contact-us-bg e-flex e-con e-child\" data-id=\"a3f81ec\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-fb3d121 elementor-widget elementor-widget-shortcode\" data-id=\"fb3d121\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"shortcode.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-shortcode\">\t\t<div data-elementor-type=\"container\" data-elementor-id=\"14847\" class=\"elementor elementor-14847 elementor-3585\" data-elementor-post-type=\"elementor_library\">\n\t\t\t\t<div class=\"elementor-element elementor-element-3a82e0d1 e-con-full e-flex e-con e-child\" data-id=\"3a82e0d1\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-b4de036 elementor-widget elementor-widget-image\" data-id=\"b4de036\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"370\" height=\"370\" src=\"https:\/\/www.protectimus.com\/wp-content\/uploads\/2024\/05\/contact-seal.svg\" class=\"attachment-full size-full wp-image-12951\" alt=\"Send Us A Message icon\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1bc85d61 elementor-widget elementor-widget-heading\" data-id=\"1bc85d61\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">\u041e\u0442\u043f\u0440\u0430\u0432\u044c\u0442\u0435 \u043d\u0430\u043c \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-cf09046 elementor-widget elementor-widget-shortcode\" data-id=\"cf09046\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"shortcode.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-shortcode\">\n<div class=\"wpcf7 no-js\" id=\"wpcf7-f11990-o1\" lang=\"ru-RU\" dir=\"ltr\" data-wpcf7-id=\"11990\">\n<div class=\"screen-reader-response\"><p role=\"status\" aria-live=\"polite\" aria-atomic=\"true\"><\/p> <ul><\/ul><\/div>\n<form action=\"\/ru\/wp-json\/wp\/v2\/pages\/18138#wpcf7-f11990-o1\" method=\"post\" class=\"wpcf7-form init\" aria-label=\"\u041a\u043e\u043d\u0442\u0430\u043a\u0442\u043d\u0430\u044f \u0444\u043e\u0440\u043c\u0430\" novalidate=\"novalidate\" data-status=\"init\">\n<fieldset class=\"hidden-fields-container\"><input type=\"hidden\" name=\"_wpcf7\" value=\"11990\" \/><input type=\"hidden\" name=\"_wpcf7_version\" value=\"6.1.2\" \/><input type=\"hidden\" name=\"_wpcf7_locale\" value=\"ru_RU\" \/><input type=\"hidden\" name=\"_wpcf7_unit_tag\" value=\"wpcf7-f11990-o1\" \/><input type=\"hidden\" name=\"_wpcf7_container_post\" value=\"0\" \/><input type=\"hidden\" name=\"_wpcf7_posted_data_hash\" value=\"\" \/>\n<\/fieldset>\n<div class=\"protectimus-form\">\n\n<div class=\"row\">\n    <div class=\"col\">\n        <span class=\"wpcf7-form-control-wrap\" data-name=\"uname\"><input size=\"40\" maxlength=\"400\" class=\"wpcf7-form-control wpcf7-text wpcf7-validates-as-required\" aria-required=\"true\" aria-invalid=\"false\" placeholder=\"\u0418\u043c\u044f\" value=\"\" type=\"text\" name=\"uname\" \/><\/span>\n    <\/div>\n<\/div>\n\n<div class=\"row\">\n    <div class=\"col\">\n        <span class=\"wpcf7-form-control-wrap\" data-name=\"email\"><input size=\"40\" maxlength=\"400\" class=\"wpcf7-form-control wpcf7-email wpcf7-validates-as-required wpcf7-text wpcf7-validates-as-email\" aria-required=\"true\" aria-invalid=\"false\" placeholder=\"Email\" value=\"\" type=\"email\" name=\"email\" \/><\/span>\n    <\/div>\n<\/div>\n\n<div class=\"row\">\n    <div class=\"col\">\n        <span class=\"wpcf7-form-control-wrap\" data-name=\"subject\"><input size=\"40\" maxlength=\"400\" class=\"wpcf7-form-control wpcf7-text wpcf7-validates-as-required\" aria-required=\"true\" aria-invalid=\"false\" placeholder=\"\u0422\u0435\u043c\u0430\" value=\"\" type=\"text\" name=\"subject\" \/><\/span>\n    <\/div>\n<\/div>\n\n<div class=\"row\">\n    <div class=\"col\">\n        <span class=\"wpcf7-form-control-wrap\" data-name=\"message\"><textarea cols=\"40\" rows=\"1\" maxlength=\"2000\" class=\"wpcf7-form-control wpcf7-textarea wpcf7-validates-as-required\" aria-required=\"true\" aria-invalid=\"false\" placeholder=\"\u0421\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435\" name=\"message\"><\/textarea><\/span>\n    <\/div>\n<\/div>\n\n<div class=\"row\">\n    <div class=\"col mb-2\">\n        <input class=\"wpcf7-form-control wpcf7-submit has-spinner\" type=\"submit\" value=\"\u041e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c\" \/>\n    <\/div>\n<\/div>\n\n<\/div><div class=\"wpcf7-response-output\" aria-hidden=\"true\"><\/div>\n<\/form>\n<\/div>\n<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-311ad2c e-grid e-con-full equal-height equal-height-mob e-con e-child\" data-id=\"311ad2c\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<a target=\"_blank\" target=\"_blank\" class=\"elementor-element elementor-element-feb2bbc e-con-full four-link e-flex e-con e-child\" data-id=\"feb2bbc\" data-element_type=\"container\" data-e-type=\"container\" href=\"https:\/\/service.protectimus.com\/en\/register\">\n\t\t\t\t<div class=\"elementor-element elementor-element-f27e21b eq-height elementor-widget elementor-widget-heading\" data-id=\"f27e21b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-heading-title elementor-size-default\">Start free trial<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-76c9612 elementor-widget elementor-widget-image\" data-id=\"76c9612\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"28\" height=\"26\" src=\"https:\/\/www.protectimus.com\/wp-content\/uploads\/2024\/02\/icon-arrow-big.svg\" class=\"attachment-full size-full wp-image-14551\" alt=\"Arrow icon\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/a>\n\t\t<a class=\"elementor-element elementor-element-4ccade8 e-con-full four-link e-flex e-con e-child\" data-id=\"4ccade8\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\" href=\"https:\/\/www.protectimus.com\/ru\/contact-us\/\">\n\t\t\t\t<div class=\"elementor-element elementor-element-45ea78d eq-height elementor-widget elementor-widget-heading\" data-id=\"45ea78d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-heading-title elementor-size-default\">Contact sales<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e65f9a1 elementor-widget elementor-widget-image\" data-id=\"e65f9a1\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"28\" height=\"26\" src=\"https:\/\/www.protectimus.com\/wp-content\/uploads\/2024\/02\/icon-arrow-big.svg\" class=\"attachment-full size-full wp-image-14551\" alt=\"Arrow icon\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/a>\n\t\t<a class=\"elementor-element elementor-element-c9d4aa4 e-con-full four-link e-flex e-con e-child\" data-id=\"c9d4aa4\" data-element_type=\"container\" data-e-type=\"container\" href=\"https:\/\/www.protectimus.com\/ru\/pricing\/\">\n\t\t\t\t<div class=\"elementor-element elementor-element-b9e4eb6 eq-height elementor-widget elementor-widget-heading\" data-id=\"b9e4eb6\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-heading-title elementor-size-default\">Pricing details<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-120f334 elementor-widget elementor-widget-image\" data-id=\"120f334\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"28\" height=\"26\" src=\"https:\/\/www.protectimus.com\/wp-content\/uploads\/2024\/02\/icon-arrow-big.svg\" class=\"attachment-full size-full wp-image-14551\" alt=\"Arrow icon\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/a>\n\t\t<a class=\"elementor-element elementor-element-e82cb51 e-con-full four-link e-flex e-con e-child\" data-id=\"e82cb51\" data-element_type=\"container\" data-e-type=\"container\" href=\"https:\/\/www.protectimus.com\/ru\/guides\/saas-service\/\">\n\t\t\t\t<div class=\"elementor-element elementor-element-d33e100 eq-height elementor-widget elementor-widget-heading\" data-id=\"d33e100\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-heading-title elementor-size-default\">Integration guides<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3de24d6 elementor-widget elementor-widget-image\" data-id=\"3de24d6\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"28\" height=\"26\" src=\"https:\/\/www.protectimus.com\/wp-content\/uploads\/2024\/02\/icon-arrow-big.svg\" class=\"attachment-full size-full wp-image-14551\" alt=\"Arrow icon\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>RADIUS Authentication with MFA: Secure Every Network Access Point RADIUS \u2014 the protocol that quietly handles authentication for most corporate VPNs, Wi-Fi networks, and network infrastructure \u2014 was built for a different era. It does its job reliably: a network device sends credentials to a RADIUS server, the server checks them against a directory, and [&hellip;]<\/p>\n","protected":false},"author":5,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"class_list":["post-18138","page","type-page","status-publish","hentry"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"Secure VPN, Wi-Fi &amp; network access with RADIUS MFA. Protectimus proxy adds 2FA with no infrastructure changes. On-prem or cloud. Start your free trial.\" \/>\n\t<meta name=\"robots\" content=\"noindex, nofollow, max-image-preview:large\" \/>\n\t<meta name=\"google-site-verification\" content=\"6gzGBVioQ9rC9iYw9El7ERlDCLpc9c0ZqgJvbvqk0t4\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/www.protectimus.com\/ru\/radius-authentication\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"ru_RU\" \/>\n\t\t<meta property=\"og:site_name\" content=\"PROTECTIMUS\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"RADIUS Authentication with MFA for VPN &amp; Wi-Fi | Protectimus\" \/>\n\t\t<meta property=\"og:description\" content=\"Secure VPN, Wi-Fi &amp; network access with RADIUS MFA. Protectimus proxy adds 2FA with no infrastructure changes. On-prem or cloud. Start your free trial.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.protectimus.com\/ru\/radius-authentication\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/www.protectimus.com\/wp-content\/uploads\/2024\/02\/protectimus-logo.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/www.protectimus.com\/wp-content\/uploads\/2024\/02\/protectimus-logo.png\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-07-02T11:39:03+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-07-06T14:13:35+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:title\" content=\"RADIUS Authentication with MFA for VPN &amp; Wi-Fi | Protectimus\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Secure VPN, Wi-Fi &amp; network access with RADIUS MFA. Protectimus proxy adds 2FA with no infrastructure changes. On-prem or cloud. Start your free trial.\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/www.protectimus.com\/wp-content\/uploads\/2024\/02\/protectimus-logo.png\" \/>\n\t\t<meta name=\"twitter:label1\" content=\"\u0410\u0432\u0442\u043e\u0440\" \/>\n\t\t<meta name=\"twitter:data1\" content=\"accounts@vipertop.com\" \/>\n\t\t<meta name=\"twitter:label2\" content=\"\u041f\u0440\u0438\u043c\u0435\u0440\u043d\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u043d\u0430 \u0447\u0442\u0435\u043d\u0438\u0435\" \/>\n\t\t<meta name=\"twitter:data2\" content=\"17 \u043c\u0438\u043d\u0443\u0442\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/radius-authentication\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/radius-authentication\\\/#listItem\",\"name\":\"RADIUS Authentication with MFA: Secure Every Network Access Point\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/radius-authentication\\\/#listItem\",\"position\":2,\"name\":\"RADIUS Authentication with MFA: Secure Every Network Access Point\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/#listItem\",\"name\":\"Home\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/#organization\",\"name\":\"Protectimus\",\"description\":\"Two-Factor Authentication Provider\",\"url\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/\",\"telephone\":\"+17867966664\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.protectimus.com\\\/wp-content\\\/uploads\\\/2024\\\/02\\\/logo-icon.svg\",\"@id\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/radius-authentication\\\/#organizationLogo\",\"width\":72,\"height\":51,\"caption\":\"Protectimus logo\"},\"image\":{\"@id\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/radius-authentication\\\/#organizationLogo\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/radius-authentication\\\/#webpage\",\"url\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/radius-authentication\\\/\",\"name\":\"RADIUS Authentication with MFA for VPN & Wi-Fi | Protectimus\",\"description\":\"Secure VPN, Wi-Fi & network access with RADIUS MFA. Protectimus proxy adds 2FA with no infrastructure changes. On-prem or cloud. Start your free trial.\",\"inLanguage\":\"ru-RU\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/radius-authentication\\\/#breadcrumblist\"},\"datePublished\":\"2026-07-02T11:39:03+00:00\",\"dateModified\":\"2026-07-06T14:13:35+00:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/#website\",\"url\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/\",\"name\":\"PROTECTIMUS\",\"inLanguage\":\"ru-RU\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>RADIUS Authentication with MFA for VPN &amp; Wi-Fi | Protectimus<\/title>\n\n","aioseo_head_json":{"title":"RADIUS Authentication with MFA for VPN & Wi-Fi | Protectimus","description":"Secure VPN, Wi-Fi & network access with RADIUS MFA. Protectimus proxy adds 2FA with no infrastructure changes. On-prem or cloud. Start your free trial.","canonical_url":"https:\/\/www.protectimus.com\/ru\/radius-authentication\/","robots":"noindex, nofollow, max-image-preview:large","keywords":"","webmasterTools":{"google-site-verification":"6gzGBVioQ9rC9iYw9El7ERlDCLpc9c0ZqgJvbvqk0t4","miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BreadcrumbList","@id":"https:\/\/www.protectimus.com\/ru\/radius-authentication\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.protectimus.com\/ru\/#listItem","position":1,"name":"Home","item":"https:\/\/www.protectimus.com\/ru\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.protectimus.com\/ru\/radius-authentication\/#listItem","name":"RADIUS Authentication with MFA: Secure Every Network Access Point"}},{"@type":"ListItem","@id":"https:\/\/www.protectimus.com\/ru\/radius-authentication\/#listItem","position":2,"name":"RADIUS Authentication with MFA: Secure Every Network Access Point","previousItem":{"@type":"ListItem","@id":"https:\/\/www.protectimus.com\/ru\/#listItem","name":"Home"}}]},{"@type":"Organization","@id":"https:\/\/www.protectimus.com\/ru\/#organization","name":"Protectimus","description":"Two-Factor Authentication Provider","url":"https:\/\/www.protectimus.com\/ru\/","telephone":"+17867966664","logo":{"@type":"ImageObject","url":"https:\/\/www.protectimus.com\/wp-content\/uploads\/2024\/02\/logo-icon.svg","@id":"https:\/\/www.protectimus.com\/ru\/radius-authentication\/#organizationLogo","width":72,"height":51,"caption":"Protectimus logo"},"image":{"@id":"https:\/\/www.protectimus.com\/ru\/radius-authentication\/#organizationLogo"}},{"@type":"WebPage","@id":"https:\/\/www.protectimus.com\/ru\/radius-authentication\/#webpage","url":"https:\/\/www.protectimus.com\/ru\/radius-authentication\/","name":"RADIUS Authentication with MFA for VPN & Wi-Fi | Protectimus","description":"Secure VPN, Wi-Fi & network access with RADIUS MFA. Protectimus proxy adds 2FA with no infrastructure changes. On-prem or cloud. Start your free trial.","inLanguage":"ru-RU","isPartOf":{"@id":"https:\/\/www.protectimus.com\/ru\/#website"},"breadcrumb":{"@id":"https:\/\/www.protectimus.com\/ru\/radius-authentication\/#breadcrumblist"},"datePublished":"2026-07-02T11:39:03+00:00","dateModified":"2026-07-06T14:13:35+00:00"},{"@type":"WebSite","@id":"https:\/\/www.protectimus.com\/ru\/#website","url":"https:\/\/www.protectimus.com\/ru\/","name":"PROTECTIMUS","inLanguage":"ru-RU","publisher":{"@id":"https:\/\/www.protectimus.com\/ru\/#organization"}}]},"og:locale":"ru_RU","og:site_name":"PROTECTIMUS","og:type":"article","og:title":"RADIUS Authentication with MFA for VPN &amp; Wi-Fi | Protectimus","og:description":"Secure VPN, Wi-Fi &amp; network access with RADIUS MFA. Protectimus proxy adds 2FA with no infrastructure changes. On-prem or cloud. Start your free trial.","og:url":"https:\/\/www.protectimus.com\/ru\/radius-authentication\/","og:image":"https:\/\/www.protectimus.com\/wp-content\/uploads\/2024\/02\/protectimus-logo.png","og:image:secure_url":"https:\/\/www.protectimus.com\/wp-content\/uploads\/2024\/02\/protectimus-logo.png","article:published_time":"2026-07-02T11:39:03+00:00","article:modified_time":"2026-07-06T14:13:35+00:00","twitter:card":"summary_large_image","twitter:title":"RADIUS Authentication with MFA for VPN &amp; Wi-Fi | Protectimus","twitter:description":"Secure VPN, Wi-Fi &amp; network access with RADIUS MFA. Protectimus proxy adds 2FA with no infrastructure changes. On-prem or cloud. Start your free trial.","twitter:image":"https:\/\/www.protectimus.com\/wp-content\/uploads\/2024\/02\/protectimus-logo.png","twitter:label1":"\u0410\u0432\u0442\u043e\u0440","twitter:data1":"accounts@vipertop.com","twitter:label2":"\u041f\u0440\u0438\u043c\u0435\u0440\u043d\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u043d\u0430 \u0447\u0442\u0435\u043d\u0438\u0435","twitter:data2":"17 \u043c\u0438\u043d\u0443\u0442"},"aioseo_meta_data":{"post_id":"18138","title":"RADIUS Authentication with MFA for VPN &amp; Wi-Fi | Protectimus","description":"Secure VPN, Wi-Fi &amp; network access with RADIUS MFA. Protectimus proxy adds 2FA with no infrastructure changes. On-prem or cloud. Start your free trial.","keywords":null,"keyphrases":{"focus":{"keyphrase":"","score":0,"analysis":{"keyphraseInTitle":{"score":0,"maxScore":9,"error":1}}},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"WebPage","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"seo_analyzer_scan_date":"2026-07-09 18:15:27","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"open_ai":null,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":[],"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-07-01 20:41:11","updated":"2026-07-09 18:15:27"},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/www.protectimus.com\/ru\/\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\tRADIUS Authentication with MFA: Secure Every Network Access Point\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/www.protectimus.com\/ru\/"},{"label":"RADIUS Authentication with MFA: Secure Every Network Access Point","link":"https:\/\/www.protectimus.com\/ru\/radius-authentication\/"}],"_links":{"self":[{"href":"https:\/\/www.protectimus.com\/ru\/wp-json\/wp\/v2\/pages\/18138","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.protectimus.com\/ru\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.protectimus.com\/ru\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.protectimus.com\/ru\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/www.protectimus.com\/ru\/wp-json\/wp\/v2\/comments?post=18138"}],"version-history":[{"count":32,"href":"https:\/\/www.protectimus.com\/ru\/wp-json\/wp\/v2\/pages\/18138\/revisions"}],"predecessor-version":[{"id":18211,"href":"https:\/\/www.protectimus.com\/ru\/wp-json\/wp\/v2\/pages\/18138\/revisions\/18211"}],"wp:attachment":[{"href":"https:\/\/www.protectimus.com\/ru\/wp-json\/wp\/v2\/media?parent=18138"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}