Authenticating with OTP

This feature depends on per-user, one-time password (OTP)methods that are supported on the firewall, including TOTP (time-based, one-time password) and OTP via mail. The firewall can correctly send enrollment and authentication requests as each step of the workflow requires. This feature only works when the Global VPN Client user is configured with one-time password method enabled in the firewall. For OTP via mail, the firewall should be configured with a mail server as a mail sender for sending OTP.

Using this form of authentication is much more secure than using only a password. It doesn’t require an internet connection to generate codes and it is safer than SMS-based codes because it is less vulnerable to SIM-swap attacks. The Global VPN Client supports both TOTP and OTP-via-mail as the one-time password methods. In addition to logging in with the typical username and password, an extra step was added for entering the verification code.