Azure VPN Gateway and MFA Timeout Issue for Point to Site Connections

[James Anderson]

Hi,

I'm having trouble getting MFA working with an Azure P2S IKEv2 VPN using RADIUS auth. It seems that the auth response timeout on the gateway is set so low (looks like 5 sec) that I don't have enough time to authenticate using MFA. I've verified this both with DUO Auth and Azure MFA; both have the same result.

I initiate the VPN connection, enter credentials, and before I can answer the phone call to verify MFA, another request is initiated and a second call comes through. If I successfully verify either or both calls, the connection fails. However, if I use a push notification to the cell phone for verification and I can verify in under 5 sec, the connection is completed.

I've also pointed my Palo Alto VPN device (where I have a specified timeout of 60 sec) at my MFA server and was able to log in successfully to that VPN - this determines the issue is not with my MFA server setup.

I've created a bug request with Microsoft on this as there doesn't seem to be a way to change the timeout.

Has anyone else encountered this issue or found a workaround??

[#2]

I'm having a similar issue when leveraging MFA server against Office 365 logins.  I'm also experiencing the 5 second timeout.  I also have two factor authentication configured for my Fortigate VPN and Remote Desktop Services and the timeout is not an issue.  The timeout only comes into play when the ADFS configuration is leveraged.  I have a case open with Microsoft for it but so far they haven't been able to figure out the issue.  I've had the case open since December 2017.  It is very annoying.