Secure VPN logins by requiring MFA for every account with no exceptions, preferring methods that resist phishing, adding device certificates, limiting login attempts, and removing local accounts that bypass your identity provider. Then test each rule by trying to break it. A policy that was never tested is a guess.
1. Require MFA with no quiet exceptions
List every way a person can authenticate to the gateway: the main portal, a legacy client, a local admin account, an API. MFA must apply to all. The usual gap is the account created years ago "just for the vendor".
2. Prefer phishing resistant methods
Push approvals and one time codes can be phished or fatigue attacked. Security keys and device bound credentials are harder to trick. If you cannot move everyone at once, start with administrators and people with access to production.
If you keep push approvals, turn on number matching and rate limit prompts so a flood of requests cannot wear someone down.
3. Add device certificates
A password plus MFA proves a person. A certificate proves a known device. Requiring both blocks a stolen credential used from an attacker's machine. Manage certificate issuance and revocation through your device management so lost laptops lose access quickly.
4. Limit and watch login attempts
- Set a lockout or increasing delay after failed attempts.
- Alert on bursts of failures from one address or against many accounts.
- Alert on a success after many failures.
- Alert on logins from unexpected countries or at impossible travel speed.
5. Remove standing local accounts
Local accounts on the gateway skip your central controls. Keep one break glass account with a long random secret in a vault, alarms on use, and nothing else. Disable the rest.
6. Check the session, not only the login
Set session lifetimes that match risk. An eight hour workday session is reasonable, a session that lasts weeks is not. Require re-authentication for sensitive networks.
7. Protect the management side
Admin interfaces should be reachable only from a small address range or a separate management network. See what to log on a VPN gateway for the events to capture.
8. Test it
Try these once a quarter:
- Sign in with a valid password and no second factor.
- Sign in from an unmanaged laptop with a copied credential.
- Use an old account that should be disabled.
- Check that failed login alerts reach a person.
Quick check
Is SMS enough as a second factor?
It is better than nothing, but it is weaker than app based or hardware methods. Move high risk users off it first.
Do service accounts need MFA?
Machine accounts often cannot use it. Give them narrow network access, certificate based authentication where possible, and monitoring of their use.
Last reviewed: 19 October 2026.
