Follow one of these procedures depending on your VPN equipment.

Configure PfSense as VPN terminator

Follow these steps to integrate your PfSense server with PacketFence Gateway.
You can implement this configuration for the following use cases:

VPN server configured as a Radius client only

To configure your PfSense server, log in to your PfSense console using your administrator credentials.
In the PfSense navigation menu, VPN > OpenVPN.
On the OpenVPN page, Select the Wizard tab.
On the OpenVPN Remote Access Server Setup page, in Type of Server select Radius, and click Next.
On the Radius Server Selection page, click Add new Radius Server.
On the Add Radius Server page, go to Radius Authentication Server Parameters and configure these settings:
a. In Name, enter the Radius server name.
b. In Hostname or IP Address, enter the PacketFence IP address.
c. In Authentication Port, enter 1815.
d. In Shared Secret, enter the same secret that you entered when registering your OpenVPN with PacketFence.
e. Click Add new Server.
On the Certificate Authority Selection page, click Add new CA.
On the Add Certificate Authority page, navigate to Create a New Certificate Authority (CA) Certificate and configure these settings:
a. In Descriptive name, enter your CA name.
b. Configure your CA localization data: Country Code in ISO format, State or Province, City, and Organization.
c. Click Create new CA.
On the Server Setup page, configure these settings:
a. In Interface, select WAN.
b. Scroll down to Tunnel Settings, and in Tunnel Network, enter the private IP address that you want to use for the PfSense and Client PC communication.
d. In Local Network, enter your IP address and click Next.
On the Firewall Rule Configuration page, enable Firewall rule and OpenVPN rule.
Click Next and Finish.
To enter the Radius server attribute meeting the PacketFence configuration, configure these settings:
a. In the PfSense navigation menu, select System > User Manager.
b. On the Users page, click the Authentication Servers tab.
c. In the Authentication Servers tab, navigate to the PacketFence server configuration and click the Edit (pencil) icon.
d. On the PacketFence server configuration page, scroll down to the bottom of the page and in Radius NAS IP Attribute, select LAN.
e. Click Save.
To download and install OpenVPN client software, follow these steps:
a. Download OpenVPN client and install it to your PC.
b. Login to the PfSense server console.
c. In the navigation menu, select System > Package Manager > Available Packages.
d. Use the search box to find the openvpn-client-export package and install it.
e. In the navigation menu, select VPN > OpenVPN.
f. In the provided menu, select Client Export.
g. Scroll down to OpenVPN Clients and download Viscosity Inline Config.
h. Send the file to your PC using Google drive or private email.
i. Start OpenVPN connect and import the file.

Configure F5 Big-IP Access Policy Manager (APM)

This procedure provides you with the configuration steps to enable an external logon page for your F5 Big-IP APM. You can implement this configuration for the following use cases:

Log in to the F5 BIG-IP management console.
In the navigation menu, select Access > Profiles/Policies > Access Profile (Per-Session Policies), and click Edit link.
In Access policy, insert External Logon Page and add External Logon Server URI of the PacketFence Gateway, and click Save.
For example enter the following login page: http://<Gateway ip address>/F5?id=%{session.logon.last.username.
With this setting, the VPN server redirects the user to the external logon page, for example, the PacketFence captive portal. In the captive portal login screen, the user is prompted for their username and password.
To add your Radius server, in the navigation menu, select Authentication >
Radius > Access Profile, and enter VPN server settings such as the IP address and Secret of the Radius server.

With this configuration, you can validate the session between the PacketFence server and the APM to check if the user has authenticated with MFA instead of bypassing the secondary authentication.
Click Apply Access Policy.

You’ve just configured your F5 BIG-IP VPN server to display an external logon page where the user authenticates using their corporate credentials.

Now, you can test your setup.

Configure Sophos Firewall/VPN

Follow these steps to integrate your Sophos server with PacketFence Gateway.
You can implement this configuration for the following use case:

VPN server configured as a Radius client only

To configure your Sophos server, log in to your Sophos console using your administrator credentials.
In the Sophos navigation menu, go to Configure > Authentication.
In the Servers tab, click Add.
On the Add external server page, in Server type select RADIUS server.
In Server name, enter the Radius server name.
In Server IP, enter the PacketFence IP address.
In Authentication port, enter 1815.
In Time-out, enter 60.
In Shared secret, enter the same secret that you entered when registering your Sophos with PacketFence.
In Group name attribute, enter the user or the group of your AD that you want to have MFA enabled for.
Click Test connection to verify your configuration.
Click Save.

You’ve just configured your Sophos VPN server to display an external logon page where the user authenticates using their corporate credentials. You can now provision users from AD and define your MFA policies.