Multi-Factor Authentication (2FA/MFA) for Barracuda SSL VPN

Last updated on July 1, 2026

Overview of MFA for Barracuda SSL VPN

Multi-Factor Authentication (MFA) for Barracuda SSL VPN is an extra layer of security that requires users to provide two authentication factors to gain access to Barracuda SSL VPN. The first factor involves the user entering their Active Directory / RADIUS username and password. After completing the first factor, the user undergoes secondary authentication using one of the available authentication methods, such as Mobile Push or Email Link. After completing both factors, the user gains access to the resource. Enabling Two-Factor Authentication (2FA) or Multi-Factor Authentication (MFA) for Barracuda SSL VPN prevents hackers from gaining access to resources even if they know the user’s login credentials.

Enable Entra ID logins to Barracuda SSL VPN using Rublon MFA

If Barracuda SSL VPN authenticates users through LDAP or RADIUS, you can use Rublon Authentication Proxy to validate primary credentials against Microsoft Entra ID and then enforce Rublon MFA. This allows users to sign in to Barracuda SSL VPN with Microsoft Entra ID credentials, even when Barracuda SSL VPN does not support Microsoft Entra ID, SAML, OAuth 2.0, or OpenID Connect natively.

See how to authenticate LDAP and RADIUS with Microsoft Entra ID credentials and MFA, or explore the related use case: Microsoft Entra ID logins for LDAP and RADIUS applications with MFA.

Supported Authentication Methods

Authentication Method	Supported	Comments
Mobile Push	✔	N/A
FIDO	–	N/A
Passcode	✔	N/A
SMS Passcode	–	N/A
SMS Link	✔	N/A
Phone Call	✔	N/A
QR Code	–	N/A
Email Link	✔	N/A
YubiKey OTP	✔	N/A
RFID	–	N/A

Before you start

You need to install and configure Rublon Authentication Proxy itself before configuring Barracuda to work with it. Read Rublon Authentication Proxy and follow the steps in the Installation and Configuration sections. Afterward, follow the appropriate Configuration section in this document.

Ensure that you have properly set up your authentication source, that is, an external Identity Provider (IdP) like FreeRADIUS.

Configuration of MFA for Barracuda SSL VPN

1. Log in to the Barracuda VPN interface.

2. Go to Users → External Authentication.

3. Select RADIUS. Fill in the form. Refer to the following image and table to learn more about the settings. Click Save to save the changes.

Server Address	Enter the IP of your Rublon Authentication Proxy server.
Server Port	Enter the port of your Rublon Authentication Proxy server.
Server Key	Enter the Rublon Authentication Proxy server Secret.
Group Attribute	Keep the default value.
Group Attribute Delimiter	Keep the default value.
NAS ID	If your RADIUS server requires NAS credentials to be set, enter the NAS identifier.
NAS IP Address	If your RADIUS server requires NAS credentials to be set, enter the NAS IP Address.
NAS IP Port	If your RADIUS server requires NAS credentials to be set, enter the NAS IP Port.
Group Information From	Set to blank/empty.

4. Go to VPN → SSL VPN.

5. Navigate to the Authentication section. Select RADIUS in User Authentication. Click Save.

6. Your configuration is now complete. Users have Rublon 2FA enabled when logging in to your VPN.

Log in to Barracuda using MFA for Barracuda SSL VPN

1. Run CudaLaunch.

2. Provide the hostname of the server you want to connect to.

3. Provide your username and password. Click Log in.

4. Check your mailbox for an email from Rublon MFA. Open the email and click Sign In.

5. You will be successfully logged in to the VPN.

Troubleshooting

Helper User Scheme is known to block connections to the Rublon API, so turn it off if you are experiencing connection issues.

If you encounter any issues with your Rublon MFA integration, contact Rublon Support.

Related Posts

Rublon Authentication Proxy

Rublon Authentication Proxy – Integrations