Description
DUO (https://www.duo.com) offers a great guide to install and configure Horizon View using DUO’s RADIUS Proxy. In their sample configuration, all users are required to 2FA whether they are logging in from the internet or a local/trusted network because the 2FA is being leveraged at the Connection server. In some cases an organization may wish for only users accessing their virtual desktops from the internet to leverage 2FA, allowing internal users to bypass 2FA at the Connection Server and only be prompted for 2FA at the desktop. DUO 2FA at the VMware Unified Access Gateway solves this desired result!
The Objective
Leverage DUO 2FA only on perimeter/internet access and not ALL Horizon View users
Configuration Procedure
Install and Configure the DUO RADIUS Proxy
The process to install and configure the RADIUS Proxy can be found at https://duo.com/docs/vmwareview.
The portion of the authproxy.cfg that we’re really focused on here in this post is the are marked in the red rectangle below:
Prepare the VMware Unified Gateway for RADIUS
Below is where we will configure the Unified Gateway to leverage the DUO RADIUS Proxy.
- Browse to the UAG at https:\\the.ip.address_or_hostname_of_the.UAG:9443/admin/index.html#!/Login
- Select Authentication Setting in the General Settings Pane
- Select the gear for settings
- Enable RADIUS switch to YES
- Authentication Type: PAP
- Add the Shared Secret you configured in the authproxy.cfg
- Enter the RADIUS Server Host Name
- Save the Settings and exit
Perform a test of the the 2FA push. You should receive a DUO prompt during the login process which looks very similar found on DUO’s site when configuring the proxy (https://duo.com/docs/vmwareview)
Conclusion
My findings have been that the UAG only has the ability to configure one RADIUS server, no fail-over or secondary server. In the example above, if the RADIUS Proxy becomes offline or unavailable for any reason, the login process will be halted until access has been recovered or the the “Enable RADIUS” switch is set back to to NO (disabled). There you have it, DUO 2FA only at the VMware Unified Access Gateway!
If you have any further ideas or thoughts, please feel free to contribute in the comments below!
Additionally, if you found this helpful, please buy a stranger a cup of coffee the next time you’re at a coffee shop.
