A simple and cost-effective way to provide secure, policy-compliant and user-friendly on-premises two-factor authentication solution with self-enrollment
Fortinet allows using external RADIUS servers as the authentication source and this will allow implementing two-factor authentication using Token2 TOTPRadius appliance as a more cost-effective alternative to the standard method.
TOTPRadius allows setting up self-service enrollment using LDAP authentication for the initial setup. The new version of the portal also allows hardware token enrollment
How to configure 2-factor authentication on a Cisco Catalyst 3750 Switch, using Microsoft Active Directory as the first factor and TOTPRadius Server as the second factor.
Token2 TOTPRadius provides the RADIUS RFC-2865 for TOTP RFC-6238 based authentication. With TOTPRadius you can integrate a large variety of third-party products and systems with multi-factor authentication. A number of enterprise products and services like VPNs, Citrix XenApp/XenDesktop, VMWare View and many others provide support for RADIUS servers to validate the second factor of user authentications. Additionally, TOTPRadius appliance is providing RESTful API for second-factor authentication and enrolment (including self-service enrolment where possible). This allows implementing a fully on-premises secure and user-friendly two-factor authentication supporting RADIUS and LDAP protocols together with HTTP API with one appliance. TOTPRadius supports OTP-only authentication based on RFC-6238 algorithm (TOTP: Time-Based One-Time Password Algorithm), Local password + OTP combined authentication as well as LDAP+OTP combined authentication. It provides a web-based administration panel and an HTTPS REST-based API service designed to enable users' self-enrollment.
VPN Portal is a subcomponent of TOTPRadius appliance and is required to implement several features, such as LDAP-based self-service enrollment, FIDO2/Passwordless or Azure AD Oauth2/SSO VPN access. To ensure the security of the VPN Portal is at the highest level, we have contracted an independent security company, SySS GmbH , which has conducted the penetration testing and produced a security certificate available below. The TOTPRadius VPN Portal component is currently labeled as "Certified Website - Approved Security" by SySS Gmbh.
Self-enrollment using RESTFul API
The main advantage of TOTPRadius is the RESTFul API that allows users to self-enrol with their software tokens such as Google Authenticator and Token2 Mobile OTP.
An example of such an integration is a self-enrollment mechanism with Citrix Netscaler/StoreFront. The integration can be done by installing our Storefront integration package and adding a new RADIUS authentication server on the Netscaler. It usually takes not more than five minutes to implement. Refer to Citrix integration manual for more details.
Self-enrollment using LDAP Enroll web interface
You can configure TOTPRadius to allow users to log in without second factor (e.g. using AD password only) for the first time and then navigate to TOTPRadius LDAP Enroll web interface (accessible only within your local network or VPN), where they can enrol the second factor independently. Administrators can also allow modifying (reenrolling) via LDAP Enroll web interface.
LDAP Proxy
The principle behind LDAP Proxy mode is that users will provide their AD or LDAP password together with the one-time passwords in the password field. TOTPRadius will then parse the password, split it into two parts and authenticate the OTP and if correct will send the AD/LDAP password part further to the AD/LDAP server configured. The order of authentication is exactly as stated above, OTP is checked first and AD after OTP is confirmed correct; this is done in order to prevent account lockouts during brute force attacks. Enabling LDAP Proxy on your TOTPRadius appliance allows implementing two-factor authentication for systems that do not natively support it, such as Cisco Meraki VPN, Cisco WLC and many others
No LDAP? Use Azure AD Proxy
We are discovering more and more organizations moving to full cloud Azure AD implementation while keeping some services, such as VPN, on-premises. As the LDAP interface of Azure AD is not accessible directly, it was not possible to configure TOTPRadius to use Azure AD as its authentication source.
High availability and hardware token management
Starting from version 0.2.2 TOTPRadius appliances can be configured in high availability mode. Appliances in slave mode will only contain a read-only database will periodically synchronize with their master appliance via HTTPS REST API. Starting from version 0.2.4, TOTPRadius has a built-in management interface for hardware tokens. The hardware management tool allows adding and importing hardware token data, verify and adjust time drift using the virtual TOTP emulator and assign the hardware token to any user with a couple of clicks.
TOTPRadius is deployed as a software-based virtual appliance that runs on two hypervisors: VMWare ESXi and Microsoft Hyper-V. Upon request, virtual appliances for other hypervisors can be provided. It is free to use with up to 5 users. You need to obtain a license to increase the number of allowed users. You can download the appliance using one of the links below:
If you already have TOTPRadius 0.2.7 or 0.2.8 deployed and configured, you can also upgrade using this package
Changelog
[0.2.9] Trusted client IP Configuration from which single factor authentication can be accepted
[0.2.9] RADIUS Dynamic attribute response based on AD Group membership
[0.2.9] Syslog option (Remote syslog server with a local copy)
[0.2.8] Additional API call for listing users (listusers , returns username and registration time in json)
[0.2.8] Backup and restore of the FIDO2 key registration
[0.2.8] Single factor mode improvement (allows both LDAP password and OTP if enabled)
[0.2.8] Allowing LDAP and Local Passwords mode coexistence
[0.2.8] Extra radius attributes
[0.2.8] Redesign of the private keys update web interface
[0.2.7] Appliance backup and restore features
[0.2.7] Import users using CSV file in Azure MFA file
[0.2.7] Azure AD Proxy mode feature
[0.2.7] Enforce HTTPS for Admin panel
[0.2.7] LDAP self-service interface localization option (+ de, fr, ru and tr)
[0.2.6] API Integration UI now shows the number of 'insecure' logins remaining
[0.2.6] Option to restrict hardware token assignment (one per user)
[0.2.6] Fallback mechanisms if the OTP submitted is incorrect: SMS via Twilio and/or Email via SendGrid
[0.2.5] LDAP-based self-service 2FA enrollment public facing web interface with an option to enroll hardware tokens
[0.2.5] LDAPS support with a possibility to upload the CA root certificate
[0.2.5] OAuth2.0-VPN Interface for Azure AD SSO
[0.2.5] FIDO-VPN Interface (with Passwordless support)
[0.2.5] Admin actions history
[0.2.5] Minor bug fixes
[0.2.4 RC1] Hardware token management and assignment feature added
[0.2.4 RC1] Non-ASCII Password allowed in LDAP Proxy mode
[0.2.4 RC1] Support for L10N of LDAP Enrollment page (EN and DE provided)
[0.2.4 RC1] Moved to Ubuntu 20 LTS
It is free to use with up to 5 users. You need to obtain a license using the link below if you need to increase the number of allowed users. After completing the purchase you will receive an email containing the order URL. To generate the TOTPRadius user licenses, click on the "generate CAL" button on the order page and provide the Host ID. The license key will be generated and sent to your email address.
Full integration including built-in self-service user enrollment integration package for StoreFront based on RESTFul API. read more ...
Cisco Meraki MX
Enabling two-factor authentication for Meraki Client VPN. Self-enrollment is possible via LDAP Enroll web interface. read more ...
Cisco ASA
This guide will document how to configure 2-factor authentication on a Cisco ASA, using Microsoft Active
Directory as the first factor and TOTPRadius Server as the second. read more ...
Fortigate VPN
RADIUS authentication source without built-in self-enrollment feature. Self-enrollment is possible via LDAP Enroll web interface.
read more...
Microsoft ADFS
Using Token2 TOTPRadius ADFS Authentication Provider with ADFS Server
MFA-protected SSH access to Ubuntu servers with LDAP or Azure AD Credentials using TOTPRAdius allowing to use hardware or software tokens for 2FA logins
For large orders, Token2 offers volume discounts.If you are interested in larger volume orders, please contact us and we will get back with a quote immediately
We detected that you are visiting this website from an EU country. We recommend to continue with our EU website.
Choose the location
We detected that you are visiting this website from United Kingdom. We recommend to continue with our GBP website. Please note that only pricing is changing, shipping is still from Switzerland
COVID19 Situation in Switzerland and France
Due to current preventive measures being taken against the COVID19 outbreak in Switzerland and France (such as border closures and potential lockdown of Geneva airport) we are expecting delays in shipping and delivery with both express delivery (Fedex/UPS) as well as the regular post In particular, as the office in France is currently not functioning, all orders placed on the EU website will be shipped from Switzerland instead.
Apologies for the inconvinience!
Shipping from Switzerland
Please note that between 13-Aug-2021 and 26-Aug-2021 our warehouse in France is under maintenance, therefore all orders will be shipped from Switzerland.
This may incur additional fees such as import duties and customs clearance fees when shipping to the EU countries.
Buy options
Please
go to the product page (click on product title or Details link) and then click on the Buy options tab to change the quantity and product options or view available stock quantity.
Token2 TOTPRadius provides the RADIUS RFC-2865 for TOTP RFC-6238 based authentication. With TOTPRadius you can integrate a large variety of third-party products and systems with multi-factor authentication. A number of enterprise products and services like VPNs, Citrix XenApp/XenDesktop, VMWare View and many others provide support for RADIUS servers to validate the second factor of user authentications. Additionally, TOTPRadius appliance is providing RESTful API for second-factor authentication and enrolment (including self-service enrolment where possible). This allows implementing a fully on-premises secure and user-friendly two-factor authentication supporting RADIUS and LDAP protocols together with HTTP API with one appliance. TOTPRadius supports OTP-only authentication based on RFC-6238 algorithm (TOTP: Time-Based One-Time Password Algorithm), Local password + OTP combined authentication as well as LDAP+OTP combined authentication. It provides a web-based administration panel and an HTTPS REST-based API service designed to enable users' self-enrollment.
VPN Portal is a subcomponent of TOTPRadius appliance and is required to implement several features, such as LDAP-based self-service enrollment, FIDO2/Passwordless or Azure AD Oauth2/SSO VPN access. To ensure the security of the VPN Portal is at the highest level, we have contracted an independent security company, SySS GmbH , which has conducted the penetration testing and produced a security certificate available below. The TOTPRadius VPN Portal component is currently labeled as "Certified Website - Approved Security" by SySS Gmbh.
The main advantage of TOTPRadius is the RESTFul API that allows users to self-enrol with their software tokens such as Google Authenticator and Token2 Mobile OTP.
An example of such an integration is a self-enrollment mechanism with Citrix Netscaler/StoreFront. The integration can be done by installing our Storefront integration package and adding a new RADIUS authentication server on the Netscaler. It usually takes not more than five minutes to implement. Refer to Citrix integration manual for more details.
The principle behind LDAP Proxy mode is that users will provide their AD or LDAP password together with the one-time passwords in the password field. TOTPRadius will then parse the password, split it into two parts and authenticate the OTP and if correct will send the AD/LDAP password part further to the AD/LDAP server configured. The order of authentication is exactly as stated above, OTP is checked first and AD after OTP is confirmed correct; this is done in order to prevent account lockouts during brute force attacks. Enabling LDAP Proxy on your TOTPRadius appliance allows implementing two-factor authentication for systems that do not natively support it, such as Cisco Meraki VPN, Cisco WLC and many others
Starting from version 0.2.2 TOTPRadius appliances can be configured in high availability mode. Appliances in slave mode will only contain a read-only database will periodically synchronize with their master appliance via HTTPS REST API. 
