[Deland01]

I need to implement 2 factor authentication into my domain on all remote access connections.Does anyone have any recommendations on good systems / solutions?We currently use Citrix but are looking to also start using VPN clients on our laptops.

[Dumber]

RSA or Cryptocard is where I've positive experience with.

[cruachan]

NAP under Server 2008 supports certifcate/smartcard authentication in association with PEAP as well.

[Ossian]

Do you have any investment in hardware already (fingerprint readers on laptops or smart card readers)? If so, this may help force your decision

Also ask yourself, what is the business case vs usernames and strong passwords?

[auglan]

Remote access vpn's with cisco routers and ASA's support xauth (extended authentication)as part of phase 1.5. So the client authenticates the correct "vpn group" then also is prompted for user authentication. This authentication can be local, RADIUS, TACACS , Active Directory with pre-shared keys or certificates. They also support group-lock which will prevent a user from logging into another vpn group. You can also look at SSL vpn's, either clientless or client based with the cisco anyconnect client. SSL clientless is by far the easiest for the end user as no client is required. You can also setup portfowards, favorites, smart tunnels etc per group/user. Pretty much the ASA/router acts as a SSL proxy.