In short: Duo VPN MFA adds a second authentication step to remote access VPN logins. The preferred method is Duo Single Sign-On (usually SAML), which shows the Universal Prompt and supports passkeys, Verified Duo Push and device checks. Older or simpler set-ups use RADIUS through the on-premises Duo Authentication Proxy, which sends a push or accepts a passcode.
Why your VPN needs MFA
A VPN portal faces the internet around the clock, and it accepts a username and password. That makes it a favourite target for password spraying, credential stuffing with passwords leaked from other sites, and phishing pages that mimic the VPN login. One valid password can be enough to put an attacker inside the network, past most other defences.
Multi-factor authentication changes that. With Duo in front of the VPN, a stolen password is not enough: the user also has to approve the login with Duo Push, a passkey, a security key or a hardware token. Cyber insurance proposal forms often ask whether remote access is protected by MFA, so check your insurer's questionnaire and see our page on MFA for cyber insurance.
Do not forget the firewall's own management interface. Several vendors' admin logins can also be put behind Duo, which protects the device that controls everyone else's access.
Two ways to connect Duo to a VPN
Duo supports VPNs in two main ways. The right one depends on what your firewall supports, how your users connect and how much control you want over devices.
| Duo Single Sign-On (SAML) | RADIUS through the Authentication Proxy | |
|---|---|---|
| How it works | The VPN hands the login to Duo Single Sign-On, which acts as the identity provider | The VPN sends a RADIUS request to the on-premises Duo Authentication Proxy |
| Password checked against | Active Directory (through the Authentication Proxy), a SAML identity provider such as Entra ID or Google Workspace, or Duo Directory | Active Directory, another LDAP directory or an existing RADIUS server such as NPS |
| Login screen | The Universal Prompt, in a browser window opened by the VPN client | No Duo screen: a push or phone call is sent automatically, or the user types a passcode |
| Methods available | All methods your policy allows, including Verified Duo Push, and passkeys or security keys where the client opens the system browser | Duo Push, phone callback and passcodes, including hardware tokens; Verified Duo Push is not supported |
| New users | Can enrol themselves inline the first time they log in | Must be enrolled in Duo beforehand |
| Device checks | Duo policies apply, including device trust and, from Duo Advantage, Duo Desktop health checks | No device trust or health checks |
| Edition | Duo SSO is included from Duo Essentials | Works with any edition's MFA |
F5 BIG-IP APM is the main exception to SAML: Duo's recommended guide for it uses OpenID Connect (OIDC) with Duo Single Sign-On, which gives the same Universal Prompt experience.
Where your firewall supports it, Duo SSO is the better long-term choice: users get a clearer prompt, admins get stronger policies, and you move away from typing codes into a VPN client. RADIUS remains useful for older devices, for VPNs without SAML support, and where an existing NPS set-up must stay in place.
Supported VPNs, firewalls and gateways
Duo publishes integration guides for most mainstream remote access products. The table below reflects Duo's documentation index in October 2026; check the current guide for your firewall's software version before you start, as several SSO guides need recent firmware.
| Product | Duo Single Sign-On | RADIUS via Authentication Proxy |
|---|---|---|
| Fortinet FortiGate and FortiClient | Yes, for IPsec VPN with FortiClient on FortiOS 7.6.3 or later, plus a separate guide for FortiGate administrator logins | Yes, for SSL VPN and FortiClient |
| Palo Alto Networks GlobalProtect | Yes, for the GlobalProtect portal and gateway | Yes |
| Cisco ASA and Secure Firewall Threat Defense | Yes, see Duo for Cisco Secure Client | Yes |
| Citrix NetScaler (formerly Citrix ADC and Citrix Gateway) | Yes | Yes |
| Ivanti Connect Secure (formerly Pulse Connect Secure) | Yes | Yes |
| F5 BIG-IP APM | Yes, using OIDC (Duo's recommended option) | Older RADIUS set-ups that used the retired embedded Duo Prompt need reconfiguring or migrating |
| SonicWall Secure Mobile Access (SMA) | Yes, for supported SMA appliances | Yes |
| Check Point remote access | Not listed | Yes |
| Cisco Meraki remote access VPN | Yes, for Meraki with Cisco Secure Client | Yes, for Meraki client VPN |
| AWS Client VPN | Yes | Not listed |
| Cisco Secure Access VPN | Yes | Not listed |
If your product is not listed, Duo also offers a generic RADIUS application for any VPN that can use a RADIUS server, and a generic SAML application for any service provider that supports SAML 2.0. We test the exact combination of firewall software, VPN client and user devices before going live.
For wider firewall choices, our sister site covers Cisco Secure Firewall.
Getting the user experience right
Most VPN MFA problems come from a handful of settings rather than from Duo itself. The points we check on every project:
- RADIUS timeouts: many firewalls wait only a few seconds for a RADIUS reply, which is not long enough for a user to find their phone and approve a push. Duo's FortiGate guide, for example, recommends raising the timeout to at least 60 seconds.
- Embedded or system browser: with SAML, some VPN clients open the login in a built-in browser window. Passkeys, Touch ID and security keys generally need the client to use the device's normal browser, so check the client settings and versions.
- Fewer prompts: remembered devices and session cookies stop users being asked again every time a tunnel reconnects. On GlobalProtect, for example, Duo's guide says the portal and gateway cookie lifetimes must match or users may see repeated prompts. On Cisco Secure Client, remembered devices need the same external browser set-up as passkeys.
- Fail mode: the Authentication Proxy can either let users in on password alone when Duo cannot be reached ('safe', the default) or block them ('secure'). Decide deliberately rather than leaving the default.
- Enrolment first: RADIUS logins cannot enrol new users, so enrol everyone before switching the VPN over, and give staff a short guide to Duo Mobile.
- Push fatigue: Verified Duo Push, where the user types a code shown on the login screen, stops a flood of prompts tricking a tired user into approving one. It needs the Universal Prompt, so it works with Duo SSO but not with RADIUS or LDAP through the Authentication Proxy. Risk-based authentication, in Duo Advantage and Premier, adds further protection.
Keep the Authentication Proxy current
Every RADIUS integration depends on the Duo Authentication Proxy, so if the proxy stops working, so does the VPN login. It is software you run yourself, and Duo regularly changes what it supports: recent releases have added support for new Duo certificate authorities, and older RADIUS options, such as the embedded Duo Prompt, have reached end of support. Duo also does not support integrations on operating systems past their vendor's end of support.
The lesson is simple: keep the proxy on a current version, follow Duo's release notes, and run at least two proxies so one can be upgraded while the other carries the load. We can monitor and update it for you.
Beyond the VPN
MFA makes a VPN much safer, but a VPN still gives a connected user broad access to the network. For specific internal web apps, SSH or RDP, Duo Network Gateway in Duo Premier publishes individual applications without a VPN client. Cloud-delivered zero trust network access is covered on our ZTNA page.
Remote desktop has its own options too: see Duo for RD Gateway and Duo for Windows Logon and RDP.
How we help
Forever Systems reviews how your users connect today, recommends SAML or RADIUS for each gateway, builds and tests the integration, enrols users in advance and writes the end-user guidance. We can also move you from an older RADIUS set-up to Duo SSO without a big-bang switch-over, one connection profile or user group at a time.
Contact us for advice or a quote.
How Forever Systems supplies and supports Cisco Duo
We supply, set up and support Cisco Duo for UK organisations, from small teams and schools to multi-site businesses.
- Edition selection: Duo Free, Essentials, Advantage or Premier, matched to your users, applications and compliance needs
- Integration design: Microsoft 365 and Entra ID, Google Workspace, AWS, VPNs and firewalls, Windows and macOS logon, RDP and RD Gateway, the Authentication Proxy and Duo Single Sign-On
- Device trust: Trusted Endpoints, device health policies and Duo Desktop, alongside your MDM
- Roll-out: user enrolment, communications, hardware tokens for staff without smartphones, and help desk processes that stop MFA fatigue
- Ongoing support: policy tuning, reporting, Cyber Essentials and cyber insurance evidence, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Duo quote, trial or roll-out plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does Duo work with FortiGate VPN?
Yes. Duo has a RADIUS guide for FortiGate SSL VPN and FortiClient using the Duo Authentication Proxy, and a Duo Single Sign-On (SAML) guide for FortiGate IPsec VPN with FortiClient, which needs FortiOS 7.6.3 or later. There is also a Duo SSO guide for protecting FortiGate administrator logins.
Can Duo add MFA to GlobalProtect?
Yes. Palo Alto Networks GlobalProtect can use Duo Single Sign-On as its SAML identity provider for the portal and gateway, or RADIUS through the Duo Authentication Proxy. With SAML, enable authentication override cookies and give the portal and gateway the same cookie lifetime so users are not prompted twice.
Should I use SAML or RADIUS for Duo VPN MFA?
Use SAML through Duo SSO where your VPN supports it. It shows the Universal Prompt, allows inline enrolment, passkeys and Verified Duo Push, and lets Duo apply device policies. RADIUS suits older devices or VPNs without SAML support, but users must be enrolled first, see no Duo screen and cannot use phishing-resistant methods.
Why do Duo push requests time out on my VPN?
Usually because the firewall's RADIUS timeout is too short. Many default to a few seconds, which is not enough time to approve a push. Raise the timeout on the VPN, following the value in Duo's guide for your product.
Can Duo protect a VPN that is not on Duo's list?
Often, yes. Any VPN that can use an external RADIUS server can work with Duo's generic RADIUS application through the Authentication Proxy, and any service that supports SAML 2.0 can use Duo's generic SAML application.