Forum Discussion
NimbostratusF5 APM 2FA through SMTP
Hello,
We need to perform 2FA but by using F5 only, we don't have other MFA solutions like Duo, Google Authenticator,....
So can we use F5 to generate token and send it to the user using his email address,
(So a token can be generated and by iRule sent to the user email address through SMTP?)
Currently, we are using internal DB for users so inside it we can add user's email address
Then, F5 APM verifies the token?
Please provide your feedback and the configuration required to do that.
We know that in VPE there is generate and validate token, so we need to use them, but only with SMTP, directly with F5
Also, it will be great if you can recommend a free or trial for 2FA solutions to be integrated with F5 APM
8 Replies
- P_Kueppers
MVP
You can do it like Injeyan_Kostas said. Or you can do it with a 2FA Auth-App like Google or Microsoft Authenticator. There is a old tutorial out there:
Lab 4: Set up Google Authenticator (GA)
I used it in the past but not like this anymore
User100000Thanks,
Do you have the exact steps needed to use F5 on its own for OTP, to send the token generated from it to the user through SMTP? without relaying on external OTP solution
- P_Kueppers
I dont unterstand your Problem Injeyan_Kostas already showed you how its done :)
- Injeyan_Kostas
Nacreous
Hi User100000
you can just use the appropriate template which you can find as macro inside VPE
just replace AD Query and Auth with Local DB and create an SMTP configuration
For trial MFA you can check DUO or Microsoft Entra
Entra might be a free option as well but without conditional access etc.
For a complete free MFA solution you could use Keycloak as IDP and use saml or oauth federation with APM- User100000
Thanks,
Do you have the exact steps needed to use F5 on its own for OTP, to send the token generated from it to the user through SMTP?
- Injeyan_Kostas
As said there is already a macro template which you can use in your APM policy for this exact reason.
- create a new policy
- add a new macro
- select macro template "AD query auth OTP by email and resources"
- add this macro to the actual policy
The only thing you have to configure yourself is your authentication method, macro uses AD but you can use local DB too, and the SMTP configuration under "System ›› Configuration : Device : SMTP"
