Remote access VPNs should require MFA (multi-factor authentication). Username and password alone aren't enough because credentials get phished.
Common second factors:
- Hardware tokens (RSA SecurID)
- Authenticator apps (time-based codes)
- Push notifications to mobile apps
- SMS codes (least secure option)
Your VPN gateway queries a RADIUS server, which connects to your MFA provider. The user enters their password plus the current code.