RADIUS second-factor modes (code, phone or both)

Each RADIUS client has a second-factor mode. The username is always the account's email and the first part is always the password.

Which modes are there?

The comma rule

The six digits after the last comma are read as a code. A person whose password ends with a comma followed by six digits must use a client in «Code» mode and the separate code prompt.

Phone approval

• The phone receives «Connect to the network» or «Connect to Lisbon VPN», with the network's name.
• The approval is that sign-in's second factor; registering the device for phone approval is the administrator's decision. The access policy does not decide this approval.
• People who only have a TOTP or HOTP code can also approve on the phone, if they linked one.

What is not offered

OCRA, CHAP, MS-CHAP and EAP (certificate-based 802.1X) are not offered. Change of Authorization (CoA) and Disconnect are not either.

What a refusal hides

An unknown user, a wrong password, a wrong code and a missing factor all get the same refusal (Access-Reject), after a comparable delay. Use the audit to learn the reason.

Where do I see the decisions?

Under «Operate» › «Audit», each decision appears as radius.classic.access. The decision's identifier is sent to the device in the Class attribute and links the accounting records.