RW IKEv2 VPN with RADIUS (NPS) - add MFA / 2-FA

RouterOS General
1

Hey Forum,

i use mostly https://help.mikrotik.com/docs/spaces/ROS/pages/11993097/IPsec#IPsec-RoadWarriorsetupusingIKEv2withEAP-MSCHAPv2authenticationhandledbyUserManager(RouterOSv7)
instead of User Manager, i use in AD’s an MS Network Policy Server (NPS) to act as RADIUS Server for my AD Users.

Works seamless with Microsoft native VPN and the Client connects very fast.

Can i add here one Layer of Security? For example add 2-FA/MFA?
Or should be that configured on the Microsoft NPS Server Role and has nothing to do with the Mikrotik VPN Setup.

Best Regards!

2

nah i answerd myself :wink:

https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-nps-extension

You can extend NPS to use Azure MFA - this is what i’m looking for.