Use Chained Authentication

For increased security, you can require Connect Tunnel users and users with Web-based access to use two different authentication methods to log in to a single realm. For example, set up RADIUS or a digital certificate as the first authentication method, and LDAP or Active Directory as the second one. See Configuring Chained Authentication for information on how to do this.