rieskaniemi.com

    yet another it blog

    How to use Azure MFA With Sophos XG Firewall

    kimmo 15/03/2020
    Sophos Logo

    With version 18 Sophos brings changes to RADIUS settings on XG Firewall. We now have possibility to set timeout for authentication and this allows us to use Azure MFA for 2-factor authentication.

    Here is few simple steps how to enable this on network policy server and on XG Firewall.

    If you do not have MFA enabled for your Office 365/Azure AD account you can enable it trough following link https://aka.ms/mfasetup or use conditional access policy to enforce MFA for user accounts.

    Only push message trough Microsoft Authenticator App or phone call can be used for 2-factor authentication with SSL VPN/Sophos Connect. To prevent users for selecting any other possible multi-factor authentication method you should disable verification options that are not supported.

    To enable or disable verification methods, complete the following steps:

    1. In the Azure portal, select Azure Active Directory, then select Users.
    2. Select Multi-Factor Authentication.
    3. From Multi-Factor Authentication, select service settings.
    4. Unselect Text message to phone and Verification code from mobile app or hardware token
    5. Click Save.

    Azure AD Premium P1 license should be enabled on all users using Azure MFA trough RADIUS extension. For more information refer to https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-licensing

    Also remind that Network policy server with Azure MFA extension redirects all requests to Azure. Server cannot be used for any other kind of authentication (I.e. 802.1x) after enabling extension.

    1. Install Network Policy Server role on Windows server. I installed mine on my LAB Domain Controllers.

    Install network policy server role trough server manager.
    Remember to register server in Active Directory.

    2. Install Azure MFA extension and configure it. Follow guide from Microsoft to enable it.

    Download:
    https://www.microsoft.com/en-us/download/details.aspx?id=54688

    Guide:
    https://docs.microsoft.com/bs-latn-ba/azure/active-directory/authentication/howto-mfa-nps-extension

    3. Create new RADIUS client with IP address of the Sophos XG Firewall.

    Use IP address of the Sophos XG Firewall as client IP. Leave rest of settings as default.

    4. Create new Connection request policy.

    Named mine Sophos XG FW Crp.
    In Conditions add NAS IPv4 address and use IP address of your Sophos XG Firewall. Leave rest of the settings as default.

    5. Create new Network Policy

    Named mine as Sophos XG FW Np.
    I only added one condition being Domain Users group. This could be your VPN allowed users group or similar.
    In Authentication methods only select PAP.

    6. Create firewall rule on RADIUS Server to allow connections from Firewall.

    Use Firewalls IP as Remote IP Address
    Procol will be UDP and ports 1812, 1813.

    7. Add authentication server in Sophos XG Firewall.

    Fill in details as following. Remember to set Time-out setting to 15 seconds (or more) and Group name attribute SF_AUTH.

    8. Test authentication trough RADIUS.

    Push message received trough mobile.
    All good.

    9. Select where you want to use RADIUS as authentication back-end.

    I selected RADIUS servers as authentication back-end for User portal and VPN.
    Tagged , ,

    18 thoughts on “How to use Azure MFA With Sophos XG Firewall”

      1. Hi,

        Unfortunately no as Sophos XG’s VPN client does not support this. In user portal it will work.

        Push message or phone call work when using VPN.

        Reply

    • Why do you say that the server cannot then be used for other types of RADIUS Auth such as 802.1x? Are you saying that if my NPS is already doing WPA2 Enterprise 802.1x there will be an issue? Thank you!

      Reply

      1. After installing Azure NPS extension server will forward all requests to azure MFA servers in the cloud. So NPS has to be dedicated for this use only.

        Reply

        1. Great article – thank you for sharing.

          So, in your example, you could setup a 3rd NPS server (with no Azure NPS extension installed) on the domain to take care of other RADIUS client needs, such as 802.1x?

          Reply

    • For anyone that seems to have tried everything and is STILL getting the “NPS Extension for Azure MFA only performs Secondary Auth for Radius requests in AccessAccept State. Request received for User username with response state AccessReject, ignoring request.” error in event viewer, I have the fix.

      You have to right-click on your network policy (named “Sophos XG FW Np” if you’re following this guide) and click “Move Up” until its processing order is #1. I just wasted a few hours trying to debug this with several dead end/incorrect errors when that is all that was preventing the auth.

      Reply

      1. Good point. On clean installstions policy should however be created with processing order 1.

        Reply

    • Is there any way to enter the 6 digit code instead of getting a pop up? Sometimes our users don’t have cell service but need to get on VPN on their laptop.

      Reply

      1. It all comes down to Access-Challenge response (to fill in code received trough app or SMS) not being sent back to the client as sophos VPN clients (or OpenVPN) does not support this. It will work on userportal only.

        Reply

        1. Thank you for this information. I were hitting my head against the wall with this. I can confirm only push message and call is supported indeed.

          Reply

    Leave a Reply

    Your email address will not be published. Required fields are marked *