![]() ![]() ![]() |
|
1101:
requiring VPN for ANY remote connection
Would RDGW be classed as a VPN proxy?
With the Azure NPS addin, MFA through 365 can be added, or else Duo has a proxy addin to force MFA when connecting via RDGW
Hmmmm
cisconz:
2fa is defined as something you know (Password) and something you have (mfa device, hardware token, access to email account that code is sent to etc) so 2 passwords is dual authentication, not 2fa/mfa
The clue is in the name. 2 factors. 2 passwords is just 1 factor.
I have managers I support access for and directors who don't want to spend lots. We use Forte Client for secure access to our NAS with individual Forte logins then individual Synology logins behind that. Works well to direct traffic. We also have local access. This covers everyone using word, excel and opening folders on the nas. Had zero issues last year or this year with remoting this way and we also use the same NAS with Synology Drive app to allow all staff access via cell phones to documents and certificates they get asked for on site.
If people want to use our accounts software etc then we use Google Remote Desktop to that persons pc. Works brilliantly. Most just use their own google account. Even my pc hating managers love it.
We have a blind pc in Chch our Auckland manager can remote onto and have discussed changing for a virtual machine with multiple logins when needed in the future. Moving our accounts online was going to be $70 a user.
Atm budget for above with 5 Forte users, 10 office users and 20 site staff, daily backups to the nas (and then about 1tb of data to an external site for our ISO accreditation) - $150 a month. Think that's pretty frugal :)
1101:
requiring 2FA for BOTH RDC & VPN seems over the top , perhaps just badly worded ?
Any external connection should have 2FA. That isn't overkill in this day in age, its the norm.
What internal resources do they need to access? Are they cloud for mail/file storage?
It sounds like you need professional assistance for this.
We use Azure Virtual Desktop for our organisation (60 concurrent users during the day). Users just head to https://rdweb.wvd.microsoft.com/arm/webclient and log in. Its great.
However a valid alternative is an On-Premise RDS environment served via an RD Gateway with it configured to use Auzre MFA (Integrate RDG with Azure AD MFA NPS extension - Azure Active Directory | Microsoft Docs). I have configured this in the past for a client around 2 years ago so Im not too sure its still valid.
Do note that if you are serving this using 2FA then you dont need a VPN. It should cover the insurance requirements. In regards to your ISP router being locked down maybe its time to find a new ISP provider lol
|
![]() ![]() ![]() |