Network MFA · RADIUS · TACACS+

MFA on every VPN, firewall, switch and access-point login.

AuthNull AAA Server is our own RADIUS and TACACS+ server for authentication, authorization and accounting (AAA). It checks the password with the Microsoft NPS, Cisco ISE or Aruba ClearPass you already run, or with its own local users if you have no directory. Then it asks for MFA before any login is accepted. No agents on your devices.

Book a demo
Does
MFA before every VPN login and every firewall, switch and access-point admin login
Replaces
Password-only VPN and device-admin logins
Needs
AuthNull AAA Server on any Linux host, with a one-line install
What it does

MFA in front of every network login.

From the remote-access VPN to the switch console in the closet. Anything with a RADIUS or TACACS+ client can point at AuthNull.

  • 01VPN logins (RADIUS)

    Point your VPN at AuthNull AAA. Every remote-access login gets MFA before Access-Accept. On FortiGate, GlobalProtect and AnyConnect it can show an “Enter code” prompt instead.

    vpn: j.doe → gw.acme.com
    → MFA · approved
    connected

  • 02Switch and router admin (TACACS+)

    Device-admin logins on switches and routers get the same MFA before the CLI opens. enable is held to the privilege level your policy sets, and every command is logged.

    ssh j.doe@switch-core-01
    → MFA · approved
    switch-core-01#

  • 03Firewall and Wi-Fi admin panels

    Firewall and access-point admin logins get MFA before the dashboard opens.

    https://fw-hq · admin login · j.doe
    → MFA · approved
    dashboard
Try it in the policy playground
Works with your RADIUS

Keep the password check you already trust.

Your existing server keeps checking the password, and AuthNull adds MFA. Put AuthNull AAA in front of it, or behind it. Either way, rolling back is a matter of pointing things back.

Option A

Point your devices at AuthNull

AuthNull AAA asks your server to check the password, keeps its reply (groups, VLANs, roles) and adds MFA.

Option B

Leave your devices where they are

Your server checks the password, then forwards the login to AuthNull for MFA. Nothing changes on the devices.

Where the password is checked

  • Microsoft NPS

    Passwords checked against Active Directory by the NPS you run today, tied to your AD groups. AuthNull adds MFA.

    Microsoft NPS setup

  • Cisco ISE

    ISE keeps its policy sets and authorization results. AuthNull adds MFA on top.

    Cisco ISE setup

  • Aruba ClearPass

    ClearPass keeps its enforcement profiles and roles. AuthNull adds MFA.

  • Active Directory

    AuthNull connects to your Active Directory and checks the password for AD users. AuthNull adds MFA.

  • No directory? Local users

    AuthNull AAA checks passwords itself for a few admin accounts, or for a site without AD.

  • Already on FreeRADIUS

    The AuthNull RADIUS Bridge module adds MFA to the FreeRADIUS you run.

    FreeRADIUS setup
How it works

Four steps from connect to accept.

AuthNull AAA sits inline on the login. The password is checked first, then MFA is required before Access-Accept. Standard RADIUS and TACACS+, no client changes.

VPN / Device
AuthNull AAA
User's phone
1
DeviceAuthNull AAAAccess-Request

The user connects. The VPN, firewall or switch sends the username and password to AuthNull AAA over RADIUS or TACACS+.

2
AuthNull AAANPS / ISE / ClearPassverify password

The password is checked by your NPS, ISE or ClearPass (with Active Directory behind it), or against AuthNull local users. A wrong password stops here, and no MFA request is sent.

3
AuthNullUser's phoneMFA

Your policy decides. An MFA request goes to the user's phone: the AuthNull app, or the Duo or Okta Verify app your users already have.

4
AuthNull AAADeviceAccess-Accept

Approved: Access-Accept with the admin role from your policy, and the session opens. Denied or timed out: Access-Reject. Every login is logged in the AuthNull console.

Verify · MFA

Works with your existing Duo or Okta. No rip and replace.

Network logins get MFA from the AuthNull app, or from the Duo or Okta Verify app your users already have. Devices that show a second prompt can take a 6-digit authenticator code instead.

  • AuthNull Authenticatorprimary
  • Duobring your own
  • Okta Verifybring your own
  • 6-digit authenticator codedevices with a code prompt
See which factors work on which protocol
Decide · Policy

Ask for MFA where it matters.

Decide allow, MFA or deny by user, group, OU, device and where the user connects from. Admin logins on core gear always get MFA, and each person gets the right admin role.

  • User
  • Group
  • OU
  • Device
  • Source address
  • Service type
See conditional access
Policy · Network admin accessenabled
WHEN
user inNetwork Admins
AND
device incore-switches, fw-hq
AND
serviceadministrative login
REQUIRE
MFA
RETURN
admin rolesuper-admin
Helps you evidence
PCI DSS 4.0 req. 8.4CMMC IA.L2-3.5.3SOC 2 CC6
FAQ

RADIUS MFA, answered.

  • It adds a second factor to anything that logs in over RADIUS or TACACS+: VPNs, firewalls, switches and access-point admin panels. AuthNull AAA checks the password, asks for MFA, and returns Access-Accept only once MFA is approved. Nothing to install on the devices.

  • Yes. AuthNull AAA sends the password to your ISE, NPS or ClearPass, keeps their reply attributes and adds MFA. Or they check the password first and forward the login to AuthNull. If you run FreeRADIUS, the AuthNull RADIUS Bridge module adds MFA to it.

  • Yes. Either point the VPN at AuthNull AAA and keep your server as the password check, or leave the VPN pointed at your server and have it forward to AuthNull. To roll back, point it back.

  • Yes. Switch and router logins get MFA before the CLI opens. enable is limited to the privilege level your policy sets, and every command is recorded. TACACS+ traffic must be encrypted with the device key; unencrypted packets are refused.

  • An MFA approval on the AuthNull app, Duo or Okta Verify works on every device. A 6-digit authenticator code works too: at an “Enter code” prompt on devices that show one (FortiGate, GlobalProtect, AnyConnect), or typed after the password as password,123456. Passkeys and security keys can't travel over RADIUS, so they aren't offered here.

  • Anything that sends RADIUS with PAP, or TACACS+. That includes Fortinet, Palo Alto, Cisco ASA/AnyConnect/IOS/NX-OS, SonicWall, WatchGuard and OpenVPN, plus admin logins on access points and Wi-Fi controllers. Set the device's RADIUS timeout to 60 seconds so users have time to approve. Not supported: devices that only send MS-CHAPv2 (for example MikroTik admin logins and Windows' built-in VPN), and 802.1X Wi-Fi network joins.

  • RADIUS requests and answers must carry a valid Message-Authenticator (protection against BlastRADIUS). An older device that can't send one has to be allowed explicitly, one device at a time. TACACS+ must be encrypted. Local-user passwords are stored as bcrypt hashes, never in plain text. A wrong password never triggers an MFA request.

  • Install AuthNull AAA on a Linux host with one command, point one VPN or test switch at it, and enforce MFA on a pilot group the same afternoon. Then widen it device by device using the integration guides.

Book a demo

We’ll map your VPN and RADIUS setup with you in 20 minutes and plan a rollout.

What happens next
  1. You send the formTwo minutes: who you are and what you want to protect.
  2. We reply within a dayAn engineer emails you to pick a time.
  3. A live 20-minute demoShown against your setup, with time for questions.
What do you want to protect?

By submitting you agree to our Terms and Privacy Policy.