Rublon

Secure Remote Access

By

Last updated on July 1, 2026

Overview

The purpose of this document is to enable Rublon Two-Factor Authentication (2FA) for users logging in to Pulse Connect Secure SSL VPN. In order to achieve that using RADIUS (e.g., FreeRADIUS) as your authentication source, you have to use Rublon Authentication Proxy, an on-premises RADIUS proxy server, which allows you to integrate Rublon with Pulse to add Two-Factor Authentication to your logins.

Enable Entra ID logins to Pulse Connect Secure SSL VPN using Rublon MFA

If Pulse Connect Secure SSL VPN authenticates users through LDAP or RADIUS, you can use Rublon Authentication Proxy to validate primary credentials against Microsoft Entra ID and then enforce Rublon MFA. This allows users to sign in to Pulse Connect Secure SSL VPN with Microsoft Entra ID credentials, even when Pulse Connect Secure SSL VPN does not support Microsoft Entra ID, SAML, OAuth 2.0, or OpenID Connect natively.

See how to authenticate LDAP and RADIUS with Microsoft Entra ID credentials and MFA, or explore the related use case: Microsoft Entra ID logins for LDAP and RADIUS applications with MFA.

Supported Authentication Methods

Authentication Method Supported Comments
Mobile Push ✔ N/A
FIDO – N/A
Passcode ✔ N/A
SMS Passcode – N/A
SMS Link ✔ N/A
Phone Call ✔ N/A
QR Code – N/A
Email Link ✔ N/A
YubiKey OTP ✔ N/A
RFID – N/A

Before you start

You need to install and configure Rublon Authentication Proxy before configuring Pulse Connect Secure SSL VPN to work with it. Read Rublon Authentication Proxy and follow the steps in the Installation and Configuration sections. Afterwards, continue with this document.

Configuration

1. Log in to the Pulse admin panel.

2. Go to Authentication → Auth. Servers.

3. Select RADIUS Server in the New dropdown, and click New Server….

4. Fill in the fields in the Settings tab. Refer to the following image and table.

NameEnter a name for your authentication server, e.g. Rublon Authentication Proxy.
RADIUS ServerEnter the IP address of your Rublon Authentication Proxy.
Authentication PortEnter the port of your Rublon Authentication Proxy.
Shared SecretEnter the RADIUS Secret of your Rublon Authentication Proxy.
TimeoutSet to 180 seconds.
RetriesSet to 3.

5. Keep the default values of all other fields. Scroll down to the bottom of the page. Click Save Changes.

6. Go to Users → User Realms → New User Realm….

7. Set a Name for your new realm, e.g., Rublon Authentication Proxy.

8. Select the previously created Rublon Authentication Proxy authentication server in the Authentication dropdown.

9. Click Save Changes.

10. Go to Authentication Policy → Password.

11. Select Allow all users (passwords of any length) and click Save Changes.

12. Select the Role Mapping tab and click New Rule….

13. Set a name of your choice for your new rule.

14. Set Rule:If username… to is *.

15. Assign a Users role. Select Users on the Available Roles list and click Add ->.

16. Click Save Changes.

17. Go to Authentication → Signing In → Sign-in Policies.

18. Click the */ URL in the User URLs table.

19. Select User picks from a list of authentication realms and select the Rublon Authentication Proxy realm you have created before. To do this, just select Rublon Authentication Proxy on the Available realms list and click Add ->.

20. Click Save Changes.

21. Your configuration is now complete. Your users can now log in to Pulse Connect Secure SSL VPN with Rublon 2FA enabled.

Log in to Pulse Connect Secure with Rublon 2FA

This example portrays logging in to Pulse Connect Secure SSL VPN via a web browser. Mobile Push has been set as the second factor in Rublon Authentication Proxy configuration (AUTH_METHOD was set to push).

1. Open the Pulse VPN login page in your browser.

2. Provide your username and password and click Sign In.

3. You will be sent an automatic push notification on your phone.

4. Tap APPROVE.

5. You will be logged in to Pulse SSL VPN.

Troubleshooting

Blast-RADIUS Vulnerability Protection

RADIUS integrations may enforce the validation of the Message-Authenticator RADIUS attribute as part of their mitigations for the Blast-RADIUS vulnerability.

The Rublon Authentication Proxy supports the Message-Authenticator attribute starting from version 3.5.3. The Rublon Auth Proxy uses the force_message_authenticator option in the configuration file (set to true by default) to safeguard against Blast-RADIUS attacks.

If you are experiencing issues with your RADIUS integration, ensure that the force_message_authenticator is set to true.

If you are using Rublon Authentication Proxy 3.5.2 or older, update to the newest available version.

If you encounter any issues with your Rublon MFA integration, contact Rublon Support.

Related Posts

Rublon Authentication Proxy

Rublon Authentication Proxy – Integrations