Microsoft provided a solution to the numerous RDP-related security woes by releasing a service called Remote Desktop Gateway (RDG). We covered in detail many of the reasons that RDP itself presents such a high risk when exposed directly to the internet. I guess this might have worked if Radius was an option in the vdi profile, but the only option there is a NTLM Auth Configuration (Big IP Machine Account in a Windows domain).The Challenge of Securing Microsoft’s Remote Access Solutionsįor decades, Microsoft’s Remote Desktop Protocol (RDP) has been used to connect to Windows computers remotely. So the access profile doesn't have any valid 'password' to send to the NPS/Radius server. I suspect this is because the access profile doesn't really participate in the NTLM authentication (challenge/response), that part is handled before the access profile - in the vdi profile.

The challenge/problem seems to be that the only place to put in a NPS/Radius server in the F5 solution is in the access profile (VPE), but if you do the NPS/Radius responds with access_reject (unknown username or password). It is done by configuring the RD Gateway to use a NPS/Radius server which in turn uses MS Azure Multifactor Authentication server (MFA) to add the second factor.Ģ-factor authentication for RDP clients is a long-awaited feature, and I hoped and believed that it was possible to make this work also with the F5 RD Gateway.Īfter hours and hours trying I have realized that its not straight forward, if possible at all. With Microsofts own Remote Desktop Gateway (2012r2) it is now possible to require 2-factor authentication for RDP clients.

Rd gateway mfa