-
Products
-
SonicPlatform
SonicPlatform is the cybersecurity platform purpose-built for MSPs, making managing complex security environments among multiple tenants easy and streamlined.
Discover More
-
-
Solutions
-
Federal
Protect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions
Learn MoreFederalProtect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions
Learn More - Industries
- Use Cases
-
-
Partners
-
Partner Portal
Access to deal registration, MDF, sales and marketing tools, training and more
Learn MorePartner PortalAccess to deal registration, MDF, sales and marketing tools, training and more
Learn More - SonicWall Partners
- Partner Resources
-
-
Support
-
Support Portal
Find answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials
Learn MoreSupport PortalFind answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials
Learn More - Support
- Resources
- Capture Labs
-
- Company
- Contact Us
Configuring One-Time Passwords
09/29/2023 
602 People found this article helpful
502,560 Views
Description
One-Time Password (OTP) is a two-factor authentication scheme that utilizes system generated, random passwords in addition to standard user name and password credentials. Once users submit the correct basic login credentials, the system generates a one-time password which is sent to the user at a pre-defined email address. The user must retrieve the one-time password from their email, then enter it at the login screen. Select the Require one-time passwords checkbox to enable this functionality requiring SSL VPN users to submit a system-generated password for two-factor authentication.
Each one-time password is single-use. Whenever a user successfully enters a valid user name and password, any existing one-time password for that account is deleted. Unused one-time passwords time out according to the time-out value set on the Users | Settings | User Session Settings interface. Administrators can enable one-time password on a Local User or Local Group basis.
CAUTION: OTP cannot be configured for Global VPN Client (GVC) users. Instead, GVC users can use RSA token for two-factor authentication. Please refer to Two Factor Authentication Using RSA Radius And SecurID For SonicWall GVC And NetExtender Clients
This article describes how to configure One-Time password.
Resolution
Resolution for SonicOS 7.X
This release includes significant user interface changes and many new features that are different from the SonicOS 6.5 and earlier firmware. The below resolution is for customers using SonicOS 7.X firmware.
Configure Mail Server Settings
To use the one-time password, the appliance must have access to a correctly configured SMTP server.
- Login to the SonicWall management GUI.
- Click Device , navigate to Log | Automation.
- Under the Mail Server Settings ,Click on Advanced and enter email Information.
In order to Enforce password complexity for One-Time Password:
- Navigate to DEVICE | Users | Settings
- Under Authentication, ONE-TIME PASSWORD section
- Enable the option Enforce password complexity for One-Time Password
- Click Accept
TIP: One time password format can include characters and numbers combined. Also you can set the minimum and maximum length of the password
Enable OTP for a Local User
- On the same Device Page, navigate to the Users | Local Users and Groups page.
- Click Add User (or edit an existing user).
- Enter a name and password for the user (for a new user).
- Select the OTP via mail method on the drop down of One-time password method.
- Under the E-mail address field enter the email address where the one-time password must be sent.
- Click OK .
Alternatively, enable OTP for a Local Group
Enabling one-time password in a group will entail all members of the group to enter a one-time password when connecting. Therefore, each member of the group must be configured with an email address to send the one-time password. LDAP users’ email addresses are retrieved from the server when original authentication is done. Authenticating remote users through RADIUS requires administrators to manually enter enter email addresses in the management interface, unless RADIUS user settings are configured to Use LDAP to retrieve user group information.
- Navigate to the Users | Local Users and Groups page, click Local Groups tab on the top.
- Click Add Group (or edit an existing group).
- Enter a name for the group.
- Select the OTP via mail method on the drop down of One-time password method.
Testing
When a user enabled with one-time password tries to login to SSL-VPN, the following prompt will appear after the user has been authenticated with the local username and password.
Simultaneously, a temporary password will be sent to the email address configured under the user. Copy and paste the password in the above page. On being authenticated, the following message will be displayed on the browser page.
Resolution for SonicOS 6.5
This release includes significant user interface changes and many new features that are different from the SonicOS 6.2 and earlier firmware. The below resolution is for customers using SonicOS 6.5 firmware.
Configure Mail Server Settings
To use the one-time password, the appliance must have access to a correctly configured SMTP server.
- Login to the SonicWall management GUI.
- Click MANAGE , navigate to Log Settings | Automation.
- Under the Mail Server Settings , enter email Information.
In order to Enforce password complexity for One-Time Password:
- Navigate to MANAGE | Users | Settings
- Under Authentication, One-Time Password section
- Enable the option Enforce password complexity for One-Time Password
- Click ACCEPT
TIP: One time password format can include characters and numbers combined. Also you can set the minimum and maximum length of the password
Enable OTP for a Local User
- On the same Manage Page, navigate to the Users | Local Users and Groups page.
- Click Add User (or edit an existing user).
- Enter a name and password for the user (for a new user).
- Enable check box Require one-time passwords.
- Under the E-mail address field enter the email address where the one-time password must be sent.
- Click OK .
Alternatively, enable OTP for a Local Group
Enabling one-time password in a group will entail all members of the group to enter a one-time password when connecting. Therefore, each member of the group must be configured with an email address to send the one-time password. LDAP users’ email addresses are retrieved from the server when original authentication is done. Authenticating remote users through RADIUS requires administrators to manually enter enter email addresses in the management interface, unless RADIUS user settings are configured to Use LDAP to retrieve user group information.
- Navigate to the Users | Local Users and Groups page, click Local Groups tab on the top.
- Click Add Group (or edit an existing group).
- Enter a name for the group.
- Enable check box Require one-time passwords.
Testing
When a user enabled with one-time password tries to login to SSL-VPN, the following prompt will appear after the user has been authenticated with the local username and password.
Simultaneously, a temporary password will be sent to the email address configured under the user. Copy and paste the password in the above page. On being authenticated, the following message will be displayed on the browser page:
Resolution for SonicOS 6.2 and Below
The below resolution is for customers using SonicOS 6.2 and earlier firmware. For firewalls that are generation 6 and newer we suggest to upgrade to the latest general release of SonicOS 6.5 firmware.
Configure Mail Server Settings
To use the one-time password, the appliance must have access to a correctly configured SMTP server.
- Login to the SonicWall management GUI.
- Navigate to the Log | Automation page.
- Enter mail server information under Mail Server Settings.
Enable OTP for a Local User
- Navigate to the Users | Local Users page.
- Click Add User (or edit an existing user).
- Enter a name and password for the user (for a new user).
- Enable check box Require one-time passwords.
- Under the E-mail address field enter the email address where the one-time password must be sent.
- Click OK .
Alternatively, enable OTP for a Local Group
Enabling one-time password in a group will entail all members of the group to enter a one-time password when connecting. Therefore, each member of the group must be configured with an email address to send the one-time password. LDAP users’ email addresses are retrieved from the server when original authentication is done. Authenticating remote users through RADIUS requires administrators to manually enter enter email addresses in the management interface, unless RADIUS user settings are configured to Use LDAP to retrieve user group information.
- Navigate to the Users | Local Groups page.
- Click Add Group (or edit an existing group).
- Enter a name for the group.
- Enable check box Require one-time passwords.
Testing
When a user enabled with one-time password tries to login to SSL-VPN, the following prompt will appear after the user has been authenticated with the local username and password.
Simultaneously, a temporary password will be sent to the email address configured under the user. Copy and paste the password in the above page. On being authenticated, the following message will be displayed on the browser page.
Related Articles
- How to Create URI List Objects/Groups on SonicOSX 7?
- How to block Hotspot Shield proxy/VPN using Advanced Application Control
- DC Security Logs with Advanced Auditing
Categories
- Firewalls > NSa Series > User Login
- Firewalls > NSv Series > User Login
- Firewalls > TZ Series > User Login
YES
NO