This message was deleted.
# citrix-netscalers
Slackbot
05/06/2020, 8:43 PMThis message was deleted.
j
Julian Jakob
05/06/2020, 9:08 PMAs I’m doing the same with different ldap policies via aaa group filtering, same should work with radius policies. Another option is to bind your nps radius auth. policy with a higher priority so there are two radius policy bound to your gw. Users can login with both radius options at the same time. If first radius accepts, auth. flow ends. If first radius fails, next radius policy will hit. If more and more users migrated to Azure mfa, switch the priority so Azure mfa is your first primary radius.
👍 2
d
David Inglis
05/06/2020, 9:21 PMThanks Julian. Good idea, makes sense, I will have a play :)
David Inglis
05/07/2020, 11:25 AMre: aaa group filtering - as i'm stuck with classic expressions and no nFactor, i can't figure out how to filter the radius policy by aaa group. I'm not sure it's possible without nfactor.
As for having two policies and letting the first one fail, in principle that is fine but the timeout values for these MFA providers are like 20s each (for push notification response) so the user could end up sitting there waiting for the first radius server to timeout, not knowing what is going on.
Unless I'm missing something we would need to upgrade to Enterprise to use nFactor to make it work.
j
Julian Jakob
05/07/2020, 8:41 PMIt should be possible, try this David:
• Create an Citrix Gateway AAA Group, example SecondFactor-Radius1 which is similar to your AD Group
• Create a radius auth server, go to more details and checkout the "Default Authentication Group", fill in SecondFactor-Radius1 again
• Do the same for your other radius group and other radius auth server
• Bind both radius policies to your single gateway with the same priority or 100 / 110 (doesn't matter because now it's filtered by the default authentication group)
• I've done this with LDAPs so I think it should also work with radius, see more informations from Carl: https://www.carlstalhood.com/citrix-gateway-ldap-authentication/#domainsaaagroup