trying to get this scenario setup.
OPNsense 26.7.7
IKEv2 VPN
Duo Proxy with MS NPS and AD for MFA push
want to force entering the user's password at every login
can't seem to find a config that makes this happen.
anyone have a similar setup that's working?
Hi,
I have not tested this exact setup with Duo Proxy, so please take this as a suggestion and not a verified answer.
With IKEv2 and EAP, the password is normally stored by the Apple client itself, in the VPN profile or in the keychain, and the firewall cannot force the client to ask again. So the setting you are looking for is most likely on the client side:
On iPhone and iPad, if you leave the password field empty in the VPN configuration, the device asks for it at every connection.
On a Mac, make sure the password is not saved in the keychain for that VPN entry.
If you deploy the profile with a configuration profile or an MDM, do not include the password in it.
The Duo push is sent at every new authentication, so you should still get it each time. One thing to watch is the timing: if the user takes a long time to approve the push, the IKEv2 negotiation can time out, so test with a short approval time first.
Sergio