AuthGuard Request a demo

VPN and Wi-Fi · RADIUS

The VPN asks for the password. The phone confirms it.

VPNs, firewalls and Wi-Fi controllers connect to AuthGuard over classic RADIUS or RadSec. People sign in with their account email and password, then confirm with an authenticator-app code or by approving on their phone.

Protect our VPN See how it works
  • RADIUS and RadSec
  • Code or phone
  • Uniform rejections
  • Audited decisions
RADIUS · Lisbon VPNillustrative example
Firewall→RadSec (TLS)→AuthGuard→Phone

VPN client

Lisbon VPN

ana@example.com

••••••••••

Phone

Connect to Lisbon VPN

25 s left

Approve
Access-Acceptdecision recorded · radius.classic.access
  1. Password
  2. Request on phone
  3. Approved
  4. Access-Accept

Watch

The VPN asks. The phone confirms.

Narrated in English, with English and Portuguese subtitles. Real product screens; people, organisations and amounts are fictitious.

How it works

Same email, the right second factor.

Each device is a RADIUS client with its own second-factor mode. The username is always the account email and the first part is always the password.

  1. 01 · Register

    Register the device

    Over UDP, identified by its source address and a shared secret, or over RadSec, identified by the device’s certificate.

  2. 02 · Mode

    Code, phone or both

    In Code mode, the VPN asks for the six digits, or the person types password,123456. In Phone mode, the person approves the request. Or both.

  3. 03 · Phone

    Approve in time

    The request shows the network’s name. The person approves within the configured wait, 25 seconds by default, with biometrics or a PIN.

  4. 04 · Record

    Every decision audited

    Every decision is recorded, and its identifier is sent to the device in the Class attribute, linking the accounting records.

Illustrative example

Working from home at 8:30, on the usual VPN.

João starts the VPN at home and types his email and password. His phone receives Connect to Lisbon VPN. He approves with his fingerprint and the tunnel comes up.

If the user is unknown, the password or code is wrong, or the second factor is missing, the VPN always gets the same rejection after a comparable delay. The reason goes to the audit log, not to the screen of someone trying to guess.

For network teams

Connect the equipment you already run.

Transport

UDP or TLS

  • Classic RADIUS (UDP) from a fixed address
  • RadSec (RADIUS over TLS), recommended across the internet
  • A shared secret generated and shown only once
  • Changes reach every server within 30 seconds
Second factor

For each person

  • TOTP or HOTP codes from an authenticator app
  • Phone approval with a wait of 5 to 60 seconds
  • People who only have a code can also approve on a linked phone
  • An optional session timeout sent to the device
Evidence

Rejections that reveal nothing

  • The same rejection for an unknown user, a wrong password or a wrong code
  • A comparable response time for every rejection
  • Every decision recorded as radius.classic.access
  • The decision identifier in the Class attribute

Worth knowing

  • CHAP, MS-CHAP, EAP (certificate-based 802.1X), OCRA, Change of Authorization and Disconnect are not supported. Use PAP with a code or phone approval.
  • Wi-Fi networks that ask for a certificate or an EAP method are outside this service.
  • Anyone whose password ends in a comma followed by six digits should use a client in Code mode, with the separate code prompt.
  • Phone approval needs Android 14 or later.

In the help centre

Pilot

Start with one VPN.

One device, ideally over RadSec, and a group of people with a phone or an authenticator app. We set up the mode and timings with you.

geral@authguard.pt