[KB3472] How do I configure my Barracuda SSL VPN™ device for use with ESET Secure Authentication?


The Barracuda SSL VPN™ is an integrated hardware and software solution enabling secure, clientless remote access to internal network resources from any web browser and, with ESET Secure Authentication (ESA), is easily made more secure with a second authentication factor.



This article describes how to configure a Barracuda SSL VPN™ to authenticate users against an ESA Server. Before proceeding, verify that you've installed the RADIUS Server component of ESET Secure Authentication and can access the RADIUS service that allows external systems to authenticate users.

Before your Barracuda SSL VPN™ device can use the ESA Server to authenticate users via RADIUS, it must be set up as a RADIUS client on the ESA Server. Next, your server running the ESA RADIUS service must be setup as a RADIUS Server on the Barracuda SSL VPN™ device. Once these configurations have been specified, you can start logging into your Barracuda SSL VPN™ using ESA OTPs.


This integration guide utilizes Client does not validate user name and password Client type for this particular VPN appliance. If you wish to utilize other Client type, refer to generic description of Client types and verify with the vendor if the VPN appliance supports it.


Step I - RADIUS client configuration

The RADIUS protocol requires that access requests to RADIUS servers include the IP address for the RADIUS client (for example, the Barracuda SSL VPN™ device).

To allow the Barracuda SSL VPN™ device to communicate with your ESA Server, you must configure the device as a RADIUS client on your ESA RADIUS Server:

  1. Log in to ESA Web Console.
  2. Navigate to Components > RADIUS and locate the hostname of the server running the ESA RADIUS service.
  3. Click the hostname, then click Create New Radius Client.
  4. In the Basic Settings section:
    1. Give the RADIUS client a memorable name for easy reference.
    2. Configure the IP Address and Shared Secret for the Client so that they correspond to the configuration of your VPN appliance. The IP address is the internal IP address of your appliance. If your appliance communicates via IPv6, use that IP address along with the related scope ID (interface ID).
    3. The shared secret is the RADIUS shared secret for the external authenticator that you will configure on your appliance.
  5. In the Authentication section apply the settings shown in Figure 1-1 below.

Configuring your RADIUS client

  • To prevent locking any existing, non-2FA enabled AD users out of your VPN we recommend that you allow Non-2FA users during the transitioning phase. It is also recommended that you limit VPN access to a security group in the Users section.
  • Make sure that the check box next to Mobile Application is selected.

Figure 1-1

ESA has now been configured to communicate with the Barracuda SSL VPN™ device. You must now configure the Barracuda SSL VPN™ device to communicate with the ESA Server. First, create a new authentication scheme, then configure the settings for your RADIUS server.


Step II - Create a new authentication scheme

To create the new authentication scheme shared secret, follow the steps below:

  1. Log in to your Barracuda admin interface
  2. Navigate to Manage System → Access Control Authentication Schemes
  3. Create a new scheme, using the following values:

    Name: "ESA RADIUS"
    Selected Modules: Add "RADIUS" from the "Available Modules" list
    Selected Policies: Add your applicable policies from the "Available Policies" list

  4. Click Add.


Step III - Configure the settings for your RADIUS server

While still in the admin interface, follow the steps below:

  1. Navigate to Manage System → Access ControlConfiguration
  2. In the RADIUS section, set the parameters shown below to the following values:

    RADIUS Server: The IP address of your ESA RADIUS server
    Backup RADIUS servers: Add any redundant ESA RADIUS servers you have set up, or leave blank otherwise
    Authentication Port: 1812
    Shared Secret:
    The same shared secret that you defined in Part I
    Authentication Method: PAP
    Time out: 30
    Authentication Retries: 2
    Reject challenge: No

  3. Click Save Changes
  4. Test the setup by navigating to the URL that you normally use for SSL VPN logins. Enter the credentials of your test user:

    - Ensure that you are using a user that has been enabled for Mobile Application 2FA using ESA
    - In the password field, append the OTP generated by the Mobile Application to your AD password. For example, if the user has an AD password of "Blink182" and an OTP of 999111, type in Blink182999111



If you are unable to authenticate via the ESA RADIUS server, ensure you have performed the following steps:

  1. Run a smoke test against your RADIUS server, as per the Verifying ESA RADIUS Functionality.
  2. If no faults were fixed and you are still unable to connect, revert to an existing sign-in configuration (that does not use 2FA) and verify that you are able to connect
  3. If you are still able to connect using the old settings, restore the new settings and verify that there is no firewall blocking UDP 1812 between your VPN device and your RADIUS server
  4. If you are still unable to connect, contact ESET technical support.