4 ms·
WireGuard is nice but needs 2FA support. Until then it can’t be used in various corporate road warrior scenarios. Also until Cisco, Juniper, etc add WireGuard
by yardstick 7y ago
WireGuard is nice but needs 2FA support. Until then it can’t be used in various corporate road warrior scenarios.
Also until Cisco, Juniper, etc add WireGuard support and enough devices are deployed with it, IPsec will remain the corporate tool of choice when connecting between different organisations. Within the same org, where you have greater control of the equipment used, WireGuard is a bit more feasible.
- treesknees 7y agoWhat you're describing (authentication/2FA) should be handled by a client application. VPN client software should handle authentication/authorization with the corporate VPN server. Once it's authenticated, it can exchange/generate the public-private keys used for the WireGuard tunnel. The VPN client then installs those keys and starts the tunnel. After that, it's up to the client and server VPN software to handle session timeouts, reconnections, host machine security policies, etc etc. None of that is the job of WireGuard itself.
- yardstick 7y agoThat’s still just one factor on the tunnel itself, which is the problem. If the keypair is discovered somehow, attackers could connect to your network without 2FA. Or am I missing something? So what software can I use now to make 2FA work with WireGuard that’s simple to use - as simple as OpenVPN (cert+user/pass is trivial in OpenVPN and supported in their clients).