View 1.5.5 iApp Access Policy with Microsoft Network Policy Server (NPS) and Azure MFA

Question

Hello,&nbsp;
Has anyone set up the VMware Horizon View 1.5.5 iApp to do multi-factor authentication against Azure MFA?  We are working through a POC, but have yet to find a full setup guide for this use case.&nbsp;
There is an on-prem Windows 2016 Server running the Network Policy and Access Services role. This provides the Network Policy Server (NPS) and RADIUS server. The BIG-IP becomes a RADIUS client of the NPS.&nbsp;
Then, there is a NPS Extension for Azure MFA that Microsoft publishes. This is installed on the NPS server and provides the two factor authentication against Azure MFA.&nbsp;
Hoping to find some guideance on this configuration- both the iApp configuration on BIG-IP and the NPS RADIUS client configuration on the NPS server.&nbsp;
Thanks&nbsp;

doug_walton_354 · Answer

I've just done the BIG-IP (13.1)/NPS RADIUS client/Azure part but not the Horizon/iAPP part&nbsp;
These were the most useful resources for me;&nbsp;
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension-vpn&nbsp;

merter_319420 · Answer

Thanks. I'll read through those. Can you share the Connection Request Policy and the Network Policy you implemented in NPS?&nbsp;

doug_walton_354 · Answer

Here is what works for me;&nbsp;
Network Policy&nbsp;
New policy = Grant Access
Condition = IP of F5 (check if its your inside interface or floating IP)
Access = Grant
Authentication = MS-CHAPv2
Framed-Protocol = PPP
Service-Type = Framed
BAP Percentage of Capacity = Reduce Multilink if server reaches 50% in 2 minutes&nbsp;
*Most of these were default &nbsp;
Connection Request Policy&nbsp;
New policy
Conditions = NAS Identifier (Name of your F5 NAS identifier that you may have set in your radius profile)
Setting =  Authentication Provider (Local Computer)&nbsp;
On the Azure side I'm just using a conditional policy that says, if user is in AD group then do MFA. I'm only using it for remote access at this point.&nbsp;

Forum Discussion

View 1.5.5 iApp Access Policy with Microsoft Network Policy Server (NPS) and Azure MFA

3 Replies

Recent Discussions

Chrome V 124+ on MacOS - Virtual Server Access Issue

F5Access | MacOS Sonoma

Transaction looks successful but file not downloading

Overwriting or adding LTM SSL Traffic cert and key using iControlREST

F5 Access Guard Deprecated: ZTA APM

Related Content

Harnessing the power of F5 BIG-IP Access Policy Manager (APM) and Microsoft

Federated AWS Console Access Made Easy: F5 BIG-IP Access Policy Manager Access Guided Configurations

Microsoft's Strike on Cybercriminals and SFX backdoor- April 1st-April 7th - This Week in Security

F5 Network Map to Json with Python

Microsoft Skype for Business Server 2015