A password should not be enough to reach the network
A password is a secret one person is supposed to know. A VPN turns it into a secret anyone on the internet can try.
VPNs accept authentication from outside the network. Firewalls themselves expose some of the most privileged administrative access in the organisation. In either case, a valid password should not be enough.
Mirket brings VPN connections and firewall administration under MFA or passwordless authentication using RADIUS or SAML.
Two ways to bring VPN and firewall access under Mirket
Both paths run on the same platform, over the same users, under the same policies. Which path fits depends on the gateway’s capabilities and the authentication architecture you want to use.
RADIUS
For VPNs, firewalls and network devices using RADIUS, Mirket becomes the authentication layer between the gateway and the identity platform. Mirket applies MFA or passwordless authentication and access policy before the answer is returned to the device.
For on-premise deployments, RADIUS and directory integration are built into the Mirket platform. With Mirket SaaS, a RADIUS Gateway runs inside your network. If you use Active Directory or LDAP, a local Mirket LDAP Gateway verifies directory credentials inside your network, so the directory password is never sent to the Mirket cloud.
SAML
For VPNs and firewalls that support SAML, Mirket acts as the identity provider. The gateway redirects authentication to Mirket, Mirket applies MFA or passwordless authentication according to policy, and the user returns to the gateway with a SAML assertion containing the required identity and group information.
SAML is not limited to the VPN connection. The firewall’s own administrative interface can also be connected to Mirket SSO. Administrators authenticate through Mirket, MFA or passwordless authentication is applied according to policy, and identity, group or role attributes are returned to the firewall for authorisation.
SAML 2.0 is the same on-premise and as a service — the same assertions, the same attributes, the same policies. Which platform you run doesn’t change what a gateway can federate to.
Use the authentication path that fits the gateway
Use RADIUS where the gateway uses RADIUS. Use SAML where federation fits better. Both are part of the same Mirket identity platform.
| Capability | RADIUS | SAML |
|---|---|---|
| VPN authentication | ✓ | ✓ |
| Firewall administration | ✓ | ✓ |
| MFA | ✓ | ✓ |
| Passwordless | ✓ | ✓ |
| EAP-TTLS | ✓ | — |
| Authorisation context | RADIUS attributes and VSAs | SAML attributes |
| On-premise | ✓ | ✓ |
| SaaS | Customer-side RADIUS Gateway | ✓ |
Three layers of protection for the same gateway
The VPN connection is one login into a firewall. The console that configures that firewall is another, and it is the more privileged of the two. What an administrator then does inside that console is a third question, and it is the one most MFA projects never reach.
| Layer | What it covers | How |
|---|---|---|
| VPN access | Remote users connecting through the gateway | RADIUS or SAML, with MFA or passwordless applied before access is granted |
| Firewall administration | Engineers signing in to the administrative console | SSO with MFA or passwordless — the same identity and the same access policies used across the organisation |
| Privileged administration | What those engineers then do in the console | Mirket PAM brokers access to the firewall’s web interface: access is controlled by PAM policy, the credential is injected rather than shown, and the session can be recorded for audit and investigation |
Authentication answers who opened the console. It says nothing about what changed once they were inside it — and on a firewall, what changed is usually the question being asked after an incident. Web & desktop application access covers how that third layer works.
RADIUS built for more than basic VPN authentication
| Built-in RADIUS | RADIUS is included as part of the Mirket platform for on-premise deployments — there is no FreeRADIUS or Microsoft NPS to license, run or patch alongside it |
| Customer-side RADIUS Gateway | With Mirket SaaS, the RADIUS Gateway runs inside the customer network while Mirket SaaS provides the identity, MFA and policy layer |
| EAP-TTLS | Mirket RADIUS supports PAP and PAP over EAP-TTLS for tunnelled EAP authentication. The gateway decides which it uses, and the same device can need different ones for different tunnel types — FortiGate IPsec with IKEv2 requires EAP-TTLS, while SSL VPN typically uses PAP |
| RADIUS attributes and VSAs | Group, role and authorisation context are returned to the gateway using standard RADIUS attributes and Vendor-Specific Attributes |
Keep the authorisation model you already built
Adding Mirket does not mean rebuilding the groups and roles already configured on the gateway. The firewall receives the identity context it needs and carries on applying its own authorisation policy.
| Over RADIUS | Standard RADIUS attributes and Vendor-Specific Attributes, with the value matched to the group name configured on the device |
| Over SAML | Identity, group and role attributes, carried in the assertion |
Use the identity platform you already have
Active Directory · OpenLDAP · Microsoft Entra ID · Google Workspace · Mirket local users
Mirket supports these identity sources across both RADIUS and SAML authentication flows, and more than one at a time. Nothing has to be migrated for a gateway to go behind MFA.
Authentication that fits the access flow
- Push notification Approve or deny on the phone
- TOTP Any RFC 6238 authenticator
- Mirket Token Rotates every 30 seconds
- Mirket OTP Single-use code in the app
- SMS Your own gateway, or ours
- Reverse MFA Second factor first, then the password
- QR code Scan to sign in, in the browser
- FIDO2 / WebAuthn Phishing-resistant, bound to your domain
- Passwordless No password entered at any point
Methods are enabled per user and per group. Passwordless works on both paths. Over RADIUS it takes one of two shapes — the user approves a push on the registered phone, or enters a code from the Mirket app in place of a password — and in the browser, on the SAML path, FIDO2, WebAuthn and QR code are available as well.
Authentication can change with context
Not every user or connection needs to be treated the same way. Mirket can apply different authentication policies based on the context of the access attempt: user, group, source IP, location, authentication method and — where identity risk scoring is running — the risk on the account itself.
Identity risk is scored by Mirket ITDR, which works on authentication the service platform is already handling — so it is available where MFA and SSO run as a service. The context rules above apply on either deployment. How the scoring works is on Adaptive Authentication.
Works with the VPN and firewall platforms you already use
Mirket integrates with VPN and firewall platforms through standard RADIUS and SAML authentication.
- Fortinet FortiGate
- Palo Alto Networks
- Cisco ASA
- Check Point
- Ivanti
- Sophos
- WatchGuard
- SonicWall
- F5 BIG-IP
- Citrix
- Barracuda
- Array Networks
…and other RADIUS- and SAML-capable VPN and firewall platforms. The current list is here.
On-premise or as a service
| On-premise | RADIUS, SAML, directory integration and authentication policy run as part of the Mirket platform inside your environment |
| As a service | Mirket SaaS provides the identity, MFA and policy service. RADIUS and local directory communication are handled by Mirket Gateways inside your network |
If you use Active Directory or LDAP, directory passwords are verified inside your network and are not sent to Mirket SaaS. The architecture behind that is set out on Deployment.
What changes with Mirket
| Before | With Mirket |
|---|---|
| Password-based VPN access | MFA or passwordless authentication |
| Direct or fragmented gateway authentication | RADIUS or SAML through Mirket |
| Firewall administrators use a separate login | SSO with MFA or passwordless for firewall administration |
| Privileged firewall sessions are difficult to audit | PAM-controlled access with session recording |
| Existing authorisation depends on device groups and roles | Authorisation context continues through RADIUS or SAML |
| Different authentication controls across gateways | One Mirket identity platform across VPN and firewall access |
Frequently asked questions
How does Mirket add MFA to a VPN?
Mirket integrates with the VPN through RADIUS or SAML and applies the configured MFA or passwordless authentication policy before access is granted. On the RADIUS path the gateway sends the credential to Mirket and receives the decision back; on the SAML path the gateway redirects the user to Mirket and receives a signed assertion.
Does VPN MFA require RADIUS?
No. Mirket supports both RADIUS and SAML authentication for VPN and firewall access. Which one you use depends on the gateway's capabilities and the authentication architecture you want — RADIUS is available on effectively every gateway, and SAML on those that federate. Where a gateway supports both, it is a design choice rather than a constraint.
Does Mirket support passwordless authentication with RADIUS?
Yes. Passwordless works on both the RADIUS and the SAML path. Over RADIUS it takes one of two shapes: the user is authenticated by approving a push on the registered phone, or enters a one-time code from the Mirket app in place of a password. The directory password is not requested in either case.
Does Mirket support EAP-TTLS?
Yes. Mirket's RADIUS server supports PAP and PAP over EAP-TTLS for tunnelled EAP authentication. The gateway decides which one it uses, and the same device can need different ones for different tunnel types — a FortiGate using IPsec with IKEv2 requires EAP-TTLS, while its SSL VPN typically uses PAP.
Can Mirket provide SSO for firewall administrator access?
Yes. SAML-capable firewall administrative interfaces can use Mirket as their identity provider, bringing administrator access under single sign-on together with MFA or passwordless authentication. Administrators then sign in under the same policies as the rest of the organisation.
Can Mirket record firewall administrator sessions?
Yes. Mirket PAM can provide controlled access to supported firewall web interfaces and record privileged administrative sessions as video and searchable text for audit and investigation. The credential is injected rather than shown to the administrator.
Which authentication methods does Mirket support?
Push notification, TOTP, Mirket Token, Mirket OTP, SMS, reverse MFA, QR code, FIDO2 / WebAuthn and passwordless authentication. Methods are enabled per user and per group, and the browser-based methods apply where the sign-in happens in a browser.
Which identity sources does Mirket support?
Active Directory, OpenLDAP, Microsoft Entra ID, Google Workspace and Mirket local users — across both RADIUS and SAML authentication flows, and more than one source at a time. Nothing has to be migrated for a gateway to go behind MFA.
How does RADIUS work with Mirket SaaS?
A Mirket RADIUS Gateway runs inside the customer network and communicates outbound with Mirket SaaS, so the gateway still sends RADIUS to an address on its own network and no inbound port is opened. Where Active Directory or LDAP is used, directory communication and credential verification are handled locally through the Mirket LDAP Gateway.
Are Active Directory or LDAP passwords sent to Mirket SaaS?
No. Active Directory and LDAP passwords are verified inside the customer network and are not sent to Mirket SaaS. The full deployment architecture is set out on Deployment: On-Premise or SaaS.
Which VPN and firewall platforms does Mirket support?
Mirket integrates with Fortinet FortiGate, Palo Alto Networks, Cisco ASA, Check Point, Ivanti, Sophos, WatchGuard, SonicWall, F5 BIG-IP, Citrix, Barracuda, Array Networks and other RADIUS- or SAML-capable VPN and firewall platforms. The current list is on Integrations.
Related
Solutions — MFA for Legacy Applications · Operating System Logon MFA · Adaptive Authentication · Passwordless Authentication
Products — Multi-Factor Authentication · Single Sign-On · Privileged Access Management