Hi team,
I'm reaching out regarding an issue I'm encountering while setting up Multi-Factor Authentication (MFA) with tokens on our Sophos Firewall.

Hi mohammed kassouat ,
Thank you for reaching out to the community, you can enable for Multi-factor authentication (MFA) for default admin, You can also refer the Profile Management for Device Access in Sophos Firewall, and Configure MFA with an authenticator app.
Thanks & Regards,
_______________________________________________________________
Vivek Jagad | Team Lead, Technical Support, Global Customer Experience
Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Hi Vivek,
Thank you for your previous response.
To clarify my situation further, I've created three new local user accounts and assigned them the administrator group. The default admin account remains untouched and serves as a backup.
My current concern:
Enabling MFA with token generation for the new admin users results in a "Login failed" error when they try to log in with their credentials.
My Questions:
Request:
I'd appreciate any insights or troubleshooting tips you can offer to resolve this login failure issue specifically with the newly created local admin users and MFA.
Thanks,
Hi mohammed kassouat The user/administrator for which MFA is enabled must enter the password in <password><passcode> format. So if this is getting followed correctly by end users while entering the password but still it is giving login failed then try to "Synchronize token time offset" once and see how it goes.
For "Synchronize token time offset" steps are given in the below help section:
https://docs.sophos.com/nsg/sophos-firewall/20.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Authentication/OneTimePassword/index.html#actions
If any of the above steps not helping then access_server service (Authentication service) debug logs will give some clue.
The command for service debug start (the same command can be used to revert service from debug):
#service access_server:debug -ds nosync (sync in HA)
To check and confirm the status of access_Server service is in debug or not:
#service -S | grep "access_server"
If no clue from logs or want to review more then I would suggest opening a support case to drive it further.
Regards,
Vishal Ranpariya
Technical Account Manager | Global Customer Experience
Sophos Support Videos | Knowledge Base | @SophosSupport | Sign up for SMS Alerts |
If a post solves your question, use the 'Verify Answer' link.