Multifactor Authentication.
Verify every user. Block every unauthorized login.
Firewalls.com carries multifactor authentication solutions from Duo, SonicWall, and WatchGuard that protect
VPN logins, cloud applications, remote desktops, and on-prem systems from credential-based attacks. MFA is
now required by most cyber insurance policies and compliance frameworks, and it is one of the highest-ROI
security controls available. Our engineers help you deploy MFA across your environment quickly, without
disrupting your users.
Expert Pre-Sales AdviceCertified reps reply in 1 hour.
Config & Managed ServicesSkip the setup. We'll do it.
POs · Tax-Exempt · Net 30Welcomed for Corp, Edu, & Gov.
Same-Day ShippingOrder by 3pm EST, ships today.
Specifications
Multifactor Authentication at a Glance
Push Notification Authentication
Push-based MFA sends a login approval request to the user's smartphone. The user taps Approve or Deny,
and the login proceeds or is blocked. Push authentication is fast, requires no code entry, and is the
most user-friendly MFA method available. WatchGuard AuthPoint and Duo both support push authentication
with additional context including the login location and application so users can spot suspicious
requests they did not initiate.
TOTP and Hardware Tokens
Time-based one-time passwords (TOTP) generate a 6-digit code in the authenticator app that changes
every 30 seconds. TOTP works without a data connection, making it useful for environments where internet
access during login is unreliable. Hardware tokens generate codes on a physical keyfob with no app or
smartphone required, which is valuable for shared workstations, industrial environments, and users who
do not carry personal smartphones.
SSO and Identity Integration
MFA platforms integrate with Active Directory, Azure AD, and LDAP to use your existing user directory
as the source of truth, so you do not maintain a separate user database for authentication. Single
sign-on (SSO) integration allows a single MFA challenge to authenticate users across multiple cloud
applications, reducing the number of prompts per day and improving adoption without weakening security
posture.
Adaptive and Risk-Based Authentication
Adaptive MFA analyzes contextual signals including user location, device health, login time, and IP
reputation to assign a risk score to each authentication attempt. Low-risk logins from a known device at
a normal time may pass with a single factor. High-risk logins, such as an access attempt from an
unfamiliar country or an unmanaged device, trigger a stronger MFA challenge or block the attempt
outright. This reduces friction for users without weakening security.
Not sure which MFA solution fits your environment?
The right choice depends on your identity provider, the systems you need to protect, your device
management posture, and what your cyber insurance policy requires. Our engineers match organizations to
the right MFA platform every day and can give you a recommendation within the hour.
Multifactor authentication requires a user to prove their identity using two or more
independent factors before being granted access. The three factor categories are something you know (a
password), something you have (a smartphone or hardware token), and something you are (a fingerprint
or face scan). By requiring at least two categories, MFA ensures that a stolen password alone is not
enough for an attacker to access your systems, which stops the vast majority of credential-based
attacks.
2FA (two-factor authentication) is a specific form of MFA that uses exactly two
factors. MFA is the broader term and includes any authentication requiring two or more factors. In
practice, the terms are used interchangeably in most business contexts. The important distinction is
not 2FA vs. MFA but whether the second factor is phishing-resistant. SMS text codes are technically a
second factor but are vulnerable to SIM-swapping attacks. Push notifications, TOTP apps, and hardware
tokens provide stronger protection.
Yes, MFA on all remote access (VPN, RDP, cloud applications) and privileged accounts
(domain admin, server admin) is now a standard condition for cyber insurance coverage from most
carriers. Some insurers also require MFA on email as a condition for social engineering coverage. If
you cannot demonstrate MFA enforcement during the application or renewal process, you may be denied
coverage, face significantly higher premiums, or see ransomware coverage exclusions added to your
policy.
Modern MFA platforms integrate with virtually every system through RADIUS, SAML, and
LDAP protocols. Common integrations include VPN clients (SonicWall, Fortinet, WatchGuard), Windows and
macOS login, Remote Desktop Protocol (RDP), Microsoft 365, Google Workspace, Salesforce, and hundreds
of other SaaS applications. On-prem applications that support RADIUS or LDAP can typically be
protected without any code changes. Platforms like Duo maintain pre-built integration libraries for
the most common systems.
WatchGuard AuthPoint is a cloud-based MFA solution that integrates natively with
WatchGuard firewalls and also protects cloud applications, VPNs from other vendors, Windows login, and
web applications through SAML. AuthPoint uses a DNA-based token that ties the authentication to the
specific phone hardware, so cloning the app to a different device does not produce valid one-time
codes. It is managed through WatchGuard Cloud alongside WatchGuard firewalls and wireless products,
making it a natural fit for organizations already running WatchGuard infrastructure.
Ready to stop credential attacks before they start?
Our certified engineers will match the right MFA platform to your identity infrastructure, integrate it
with your VPN and cloud apps, and make sure every privileged account is protected before you renew your
cyber insurance.
