TOTPRadius Network configuration
TOTPRadius – standard implementation diagram
The network diagram below is a recommended setup for a single TOTPRadius network (without VPN Web portal interface activated):
As shown on the diagram, access to TOTPRadius appliance is limited to 3 other hosts only:
- RADIUS port from your VPN server to TOTPRadius appliance (UDP 1812)
- LDAP or LDAPs ports ( TCP 389/636 )from TOTPRadius to your Active Directory Domain controller
- Access to the TOTPRadius management interface ports (SSH, HTTP and HTTPS – tcp 22, 80 and 443) is recommended to be restricted to admin workstations only
TOTPRadius – VPN Web Portal implementation diagram
If you wish to implement FIDO2/Passwordless or Azure AD (Microsoft Entra ID) Oauth2/SSO VPN access for your users (available starting from v0.2.5), there is an additional configuration required in your network layout. The web portal is running as a separate web server on the same virtual appliance, instead of standard https port (443) used for admin interface, the VPN web portal responds on port 9443. This port cannot be used directly for technical reasons, so has to be NATted to port 443.
The network diagram in this case will look like shown below:
Below is the description of how such NATting can be configured using Meraki MX64 as an example.
Login to Meraki Cloud Dashboard, and navigate to your Network. Then, navigate to “Security & SD-WAN” and select Firewall
Then, scroll down to 1:Many NAT section and add a NAT rule as shown on the example below
Once this is configured, the VPN Web interface should be accessible from public Internet via https://public_IP/ URL (where public_IP is the one you specified in the 1:Many NAT rule). Leave "Allowed remote IPs" empty or "Any" if you plan to expose the appliance without using any CDN. Please note that both FIDO2 and Oauth2 interfaces require an FQDN with a valid Web Certificate in order to function properly.
About
Installation and configuration
- Installation and initial configuration
- Network configuration
- Migrating from older versions
- LDAP Configuration
- Azure AD Configuration
- Self-service enrollment portal
- Web and LDAPS Certificates
- Syslog configuration
- Single-factor authentication exceptions
- Slave appliance mode
- Dynamic RADIUS Attributes
Integration guides
Blog
17-10-2023
Automating programmable token provisioning tasks with token2-config.exe
The Token2 Configuration Tool (token2-config.exe) is a versatile and robust command-line utility specifically designed for configuring Token2 TOTP NFC Programmable tokens. This feature-rich tool is engineered to seamlessly integrate into batch files, allowing you to effortlessly automate an array of token programming and management tasks, ensuring enhanced efficiency and control over your token deployment and maintenance procedures.
18-08-2023
Introducing the New Python-Powered TOTP tool for Token2 FIDO2 Security Keys!
Manage and use TOTP/HOTP codes via Python CLI script using a PC/SC device (USB NFC) or directly via USB. A cross-platform solution that works under Windows, macOS and Linux platforms.
Python-based tools are essential not only for their cross-platform compatibility, but also because their source-available nature allows experts/developers to examine the source code, ensuring transparency and minimizing the risk of hidden vulnerabilities or malicious elements. A GUI wrapper for the script is also available.
23-06-2023
Mass Production of Token2's PIN+ Series: Enhanced FIDO2 Security Keys
Token2 is excited to announce the upcoming mass production of their revolutionary PIN+ series, a line of FIDO2 Security keys. These security keys feature advanced PIN complexity rules that set a new standard for security. The firmware development for the PIN+ series is now complete, and the company is currently making preparations for mass production.