Skip to content

MFA on RDP: what are the options?

RDP (Remote Desktop Protocol) is one of the most used technologies for access to server based applications or desktops and to enable remote user access. Unfortunately, using RDP in its simplest forms is a huge security risk. The UK NCSC (National Cyber Security Centre) has identified unprotected RDP to be the #1 reason for ransomware attacks (more on this topic). And these antics take can take place really, really fast…

A “honeypot” experiment from Unit 42 in the summer of 2021 found that 80% (!) of its unprotected RDP setups was hacked within 24 hours. Ouch. And these attacks are not isolated: on average, the honeypot RDP environments are attacked every 11 hours.

Multi-factor authentication

One of the recommendations to protect RDP environment from getting hacked is to add MFA (Multi-Factor Authentication). Note that this is one of but far from the only recommendation.

You‘d think the fact that many businesses are not using MFA on top of the RDP today is because there is a lack of solutions. However, the opposite is true: the number of options in the MFA space are as plenty as there are fish in the ocean. At Awingu, we also provided built-in MFA capabilities as part of the product since day 1.

The purpose of this post is to bring some structure into your options. We’ll add some specific vendor solutions, but keep in mind that there are many players in this domain. Rather than comparing vendors, let’s look into the architecture, the complexity of setup and the cost elements in play. We’re not making any analysis (or judgement) on which MFA token generation is better than other in this blog: e.g. is SMS as a token as secure as a time-based token generated on a phone?, etc.

The high-level options of MFA

On the highest level, MFA can be added on top of RDP by using:

  • An MFA vendor/product such as Duo Security, OKTA MFA, … and many more;
  • Using an external Identity Provider (IdP) and the MFA services linked to this IdP. Specifically we look at Microsofts Azure AD and the linked Azure MFA service. (more on the setup and requirements);
  • Using a VPN (let’s assume with an MFA-based authentication) before enabling access to the RDP service. It would still be best practice to add MFA on top of the RDP service additionally;
  • Certificate-based authentication where the certificate sort-of takes the role of the second factor;
  • Awingu, a browser based remote access solution that makes RDP-based apps/desktops available in HTML5 (on any browser). Awingu comes built-in with MFA options and enables combinations with (1) third-party MFA products and (2) Identity Providers (IdP).


MFA solutions comparison chart

In this comparison, we have made a distinction between (a) Remote desktop deployments that leverage the RDP client to launch RDP services and (b) deployments with Remote Desktop Gateway. The latter is a web application that enables launching RDP services from the browser and from there opening a config file that will push the locally installed RDP client on the device to open. The benefit of using a Remote Desktop Gateway is that only port 443 (https) is open. Option (a) requires opening port 3389 for external use, which is a no-go from a security point-of-view.

For completeness sake: Awingu does not require the use of RD Gateway. It connects over RDP to RD Session hosts (server of desktop) and then acts as an HTML5 Gateway, making all sessions available in https in the browser (using just port 443). RDP as such is not made available externally. While Awingu replaces the need for RD Gateway, it actually offers tons more.

Comparing the MFA options

Dare to compare… even if it feels a bit like comparing apples with oranges. We’ve tried to come with a perspective on:

  • Complexity: the more complex, the more room for failure and the more time-consuming;
  • Cost: what are the different elements that need to be purchased or installed (e.g. consuming infrastructure)?;
  • Any device access: this could be relevant when you, for example, allow BYOD for your employees, or when you have external users (such as contractors) that access your RDP services;
  • Relative Risk Assessment: the most tricky of them all. For one, because the (correctness of the) deployment itself plays a big role. And for two, because there are differences within each category (for which we’re making full abstraction).


MFA solutions comparison chart

How does Awingu fit the MFA list?

Awingu is not an MFA product. If you ask Gartner, Awingu is a Unified Workspace. It aggregates different applications (and desktops and file servers) and makes them available in the browser via its ‘RDP-to-HTML5’ gateway. These can be RDP-based services, but could also be web applications (that leverage the Awingu Reverse Proxy). Having all applications available in a browser is really convenient: there is no local data on the device, and I can work from any device (whatever the formfactor).


Awingu workspace

Next to offering a ‘workspace’, Awingu really adds a lot of ‘Zero Trust‘ security capabilities. Especially on top of typically vulnerable RDP environments, these are very interesting because all security features are part of the same product and they can be activated and managed from the same Awingu management console (via the Awingu System Settings).


Zero Trust features of Awingu

ne of the built-in features is… MFA. Awingu will enable Time-based (TOTP) as well as Counter-Based (HOTP) token generation. And end-users can just install an authenticator App on their phones such as Microsoft Authenticator or Google Authenticator. It is all part of the package. (How to install MFA in Awingu? Easy, take a look at our MFA technical session video.)

If you desire more token options, then Awingu can enable using other systems as well (such as RADIUS based services, or DUO security, or IdP based services such as Azure MFA or IdenProtect.)

Curious to know what the one thing is that all Awingu customers and partners like? Well, it’s the fact that Awingu is so simple to set up and manage. This simplicity is driven by the architecture: a simple virtual appliance that can be installed in your cloud (infrastructure) of choice. The Awingu Virtual Appliance will then act as a gateway and connect using standard protocols to your back-end: RDP, WebDAV, CiFS, …


Architecture of Awingu

This means you don’t need to install (or manage) anything extra in the back-end. And also towards the end-user device there is nothing to install. The only thing they need is a browser (be it on a Chromebook, iPad or Windows device…).

What is the cost of Awingu?

Our recommended end-user pricing is publicly available. The smallest deployment has 20 concurrent users. Other than the user-based Awingu licensing, the only extra cost that applies is one (or more) virtual machines (and RDS CALs, but for the sake of this blog post: all solutions will require RDS CALs).

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Parallels 
Parallels® is a global leader in cross-platform solutions, enabling businesses and individuals to access and use the applications and files they need on any device or operating system. Parallels helps customers leverage the best technology available, whether it’s Windows, Linux, macOS, iOS, Android or the cloud.

Safetica NXT – SaaS DLP introduction

Safetica NXT, the next-gen SaaS DLP, is a cloud-native solution with super-easy management and flexible subscription. Its risk-driven incident detection is powered by data analytics.

With Safetica NXT, you get:

  • Data discovery (Full audit of sensitive data flow)
  • Data protection (setting up of data protection rules)
  • Incident detection and response (risk assessment)
  • Regulatory compliance (GDPR, HIPPA, PCI-DSS)
  • Fast alerts and intuitive reports

Information at your fingertips:

Overview of the Safetica NXT environment

When opening Safetica NXT, you will land on the Dashboard. It will give you an overview of the most pressing issues that transpired in the environment and show you what might need your attention.

The Data security section lets you scan files for sensitive data, create your own rules for risk detection, create your own protection rules, and investigate detected events for data leaks.

The Workspace section displays the results of our smart detection in your company’s digital workspace, so you can immediately see which web upload domains, outgoing email domains, and external devices (USBs) can be considered as safe or which ones needs to be reviewed. In this section you can also move safe domains and devices into a safe zone.

The Employees section lets you see the number of protected users, their risky events and endpoint use. You can install Safetica to a new endpoint by visiting the endpoint tab.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Safetica
Safetica is to provide small and mid-sized companies with the same quality data protection that corporations have – affordably, and without any additional IT administration or disruptions in operation.

特殊教育最佳溝通輔具 – Shawn Joraanstad 使用案例分享


Barbara Mayer,黑鶉公立日間學校(Black Partridge Public Day School)教授。使用IPEVO V4K 視訊教學攝影機將課程內容投影至大螢幕上。

Shawn Joraanstad是黑鶉公立日間學校(Black Partridge Public Day School)的助理主任。這間學校針對重大社會/情感/行為需求的學生,提供了專門課程。


Shawn Joraanstad是黑鶉公立日間學校(Black Partridge Public Day School)的助理主任,專門研究自閉症和社交情緒障礙領域的教育管理員。

校的工作性質非常敏感,所以教職員需要最好的教學工具,讓教學品質更好,並且以更靈活的方式發展課程,就在那時他們找到了 IPEVO 愛比科技。

談到 IPEVO 愛比科技,黑鶉學校的資深教師 Barb Mayer 說: 「大約3年前,我去羅阿諾克市(Roanoke)參加星期六教師研習時,發現了IPEVO。在智慧白板出現之前,我曾經使用過一種比較老舊的設備,叫『ELMO』。我會在白板上寫出所有內容,這對於我們班有社交情感/學習障礙、感覺調節障礙和一些自閉症學生來說,是非常乏味的。」

IPEVO 愛比科技的視訊教學攝影機提供了 Shawn、Barb 和黑鶉學校全體教學人員靈活的溝通工具,能以更活潑的方式呈現課堂內容,學生投入的表現也反映出這種上課方式的好處。

Barb 進一步表示: 「使用 IPEVO 愛比科技將影像投射到電視上,讓學生可以從教室中的任何角落觀賞到我們所分享的教學內容。當我開始上課時,學生會自動將注意力轉移到螢幕上的課程,明確地知道老師在做什麼。」

在將 IPEVO 愛比科技的產品納入教室的必備工具後,Shawn 很肯定的承諾會向其他老師推薦 IPEVO 愛比科技。

「毫無疑問地,本校所有的老師都有 IPEVO 愛比科技產品!我們是一所小型的新學校,為社會情緒適應困難的學生提供課程服務,而 IPEVO 愛比科技產品幫助課程的展示與呈現,提供了經濟又可靠的解決方案。」

關於Version 2

Version 2 Digital 是立足亞洲的增值代理商及IT開發者。公司在網絡安全、雲端、數據保護、終端設備、基礎設施、系統監控、存儲、網絡管理、商業生產力和通信產品等各個領域代理發展各種 IT 產品。透過公司龐大的網絡、通路、銷售點、分銷商及合作夥伴,Version 2 提供廣被市場讚賞的產品及服務。Version 2 的銷售網絡包括台灣、香港、澳門、中國大陸、新加坡、馬來西亞等各亞太地區,客戶來自各行各業,包括全球 1000 大跨國企業、上市公司、公用事業、醫療、金融、教育機構、政府部門、無數成功的中小企及來自亞洲各城市的消費市場客戶。

關於IPEVO
IPEVO源自於PChome Online硬體事業部門,2007年7月正式獨立。自2004年於台灣營運Skype網絡電信服務,使台灣成為Skype全球發展中最成功的市場。2005年起以IPEVO品牌推出一系列Skype專屬硬件產品,將Skype虛擬服務轉化為使用者實質經驗。IPEVO以簡單、實際且具有價值的經驗為產品目標,其簡潔俐落的產品風格呼應著IPEVO的核心思考與產品精神。目前已研發之產品包括:Skype有線USB話機、Skype無線話機、Skype會議系統、Skype視訊設備、Stand-alone免電腦Skype話機。

What is a network monitoring system?

Network monitoring is a set of automatic processes that help to detect the status of each element of your network infrastructure.

We are talking about routers, switches, access points, specific servers, intermediate network elements, and other related systems or applications (such as web servers, web applications, or database servers).In other words, network monitoring can be understood as taking a look at all the connected elements that are relevant to you or your organization.

What is a network monitoring system?

A network monitoring system is that set of software tools that allows you to program those automatic polls.

That way you may constantly monitor your network infrastructure, doing systematic tests so that, if they find a problem, they notify you.

These systems makes monitoring the network easy, as they also allow you to see all the information in dashboards, generate reports on demand, see alerts and, of course, see graphs with the monitoring data relevant to you.

How does network monitoring work?

Network monitoring can be as simple as seeing devices respond to a simple command like ping. So you will see whether they are connected, switched on and “alive”.

If you do that every five minutes, you’ll be actively monitoring those machines.

We don’t care if they’re servers or routers. We’ll know that, at least, they’re there and they’re responding. When one stops responding, you’ll know something happened to it.

It can also be as basic as periodically interrogating a router for the number of bytes it has transferred, both up and down.

With that you may create network traffic graphs.

We could even add more data to it, like the number of lost packets, latency times…

These data can be combined in graphs that visually compare some values with others and even set thresholds that warn you whether a data exceeds a certain value, for example, if packet loss exceeds 10%.

If you apply that same philosophy to monitoring other data, such as the temperature in a power supply, the process will be the same: obtain the data every X time, draw it on a graph and set thresholds to generate alerts.

This is network monitoring and, as it is evident, it can be easily extended to server, application or database monitoring.

Usually network monitoring is done using remote methods, so that from one place, you may scan the network and get information from your devices.

What is a network monitoring protocol?

In order to perform these network surveys, you need what are known as network monitoring protocols. They define how communication inside a network (in order to monitor systems and devices) can be done.

There are several different monitoring protocols that allow these types of surveys to be carried out.

1. SNMP Protocol

The best known monitoring protocol is SNMP (Simple Network Management Protocol) which allows you to probe a computer and ask for different values. For example, the number of bytes you have transmitted or the temperature of your power supply.

These values are identified by a numeric code, called an OID.

For example, the OID for obtaining the temperature of a power supply on a CISCO computer is as follows: 1.3.6.1.4.1.9.9.13.1.3.1.3

2. ICMP Protocol

Another basic protocol is the ICMP, which allows to know whether the machine responds (commonly known as “pinging” or ping test).

This protocol can also be used to calculate latency times (find out how long it takes for a packet to arrive from one machine to another).

Certain network applications, such as IMAP, DNS or SMTP have their specific ports and finding out whether a service is working properly is directly related to protocol design, so more complex testing is needed.

Generally any service that is offered over the network exposes a TCP port, so monitoring that those ports are active and responsive can already be basic monitoring.

Network Monitor Basics

We could say that, in addition to the aforementioned pings, there are three methods for monitoring a network.

1. Bandwidth Monitoring

Network bandwidth is the amount of information that circulates through a network link at any given time.

This information is usually measured in bits per second and allows you to know how overloaded or underutilized your networks are.

In order to measure it, there are several tools that analyze the network bandwidth, the communication protocols used, and so on.

2. TRAP Monitoring

TRAPS are urgent notices that circulate through the network, thanks to a protocol that allows it and an emitter/collector that generates and/or collects them.

Virtually all network devices allow these urgent warnings to be sent to a trap collector.Be careful! The SNMP survey should not be mistaken with the SNMP traps.

The first is a server that asks the device regularly, using SNMP, and in the second case, it is the device that occasionally, when something happens, sends a trap to the server. Both devices can be seen as network monitors, as they perform monitoring tasks using network monitoring protocols.

3. Syslog monitoring

Another method used is log or report collection (usually via syslog).

For this, as with the traps, you must set in motion a syslog collection server that will collect logs from all the devices that you configured for this purpose.

What are the benefits of a network monitoring system?

Knowing the status of all equipment at a glance allows you to know if there are any problems and anticipate as much as possible their impact.

If something goes wrong, you’d better be the one to warn your clients or bosses, not the other way around.

If something goes wrong, in addition to knowing what went wrong, you will be able to answer questions such as:

  • Since when does it fail?
  • What other things are failing?
  • What was the normal performance?

What network monitoring tools are there?

From Pandora FMS we have done an analysis of the best network monitoring tools there are. We have compared them and here are our conclusions:

Best network monitoring tools

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

What is Packet Loss & How Can it Affect Your Network?

What is Packet Loss & How Can it Affect Your Network?

At Pandora FMS, we know that even the most minor of network issues can quickly throw a wrench in your company’s daily operations. One of the most common network issues many experience is known as packet loss.

Here, our team of network monitoring experts goes into detail about what packet loss is, as well as how to measure it and resolve it when necessary, so read on!

What is Packet Loss?

In the simplest terms, packet loss is when one or more “packets” fail to meet their destination. In most cases, it can be a minor issue that crops up in the background of your network from time to time. In fact, many applications are designed to manage package loss by relying on the built-in retransmission solutions available from transmission control protocols or by having a monitored acceptable level of packet loss.

Is there Acceptable Packet Loss?

As mentioned previously, packet loss can often be a minor issue, but that doesn’t mean it should go unaddressed. In terms of network monitoring, there is an acceptable level of packet loss (around %1 or so) that can happen and your operations will remain unaffected. This is because things like SIP or VoIP systems are designed to tolerate a small amount.

How is Packet Loss Caused?

One of the most common causes of packet loss is having links close to maximum throughput that start dropping packets, in other words, congestion. However, there are other causes as well, like general radio-based issues, faulty hardware and in some cases, a device will purposefully drop packets for routing purposes or to limit traffic throughput.

What are the Effects of Packet Loss?

Minimal packet loss isn’t likely to affect your network too much. However, extensive packet loss will greatly reduce the speed of any throughput connection, reducing the quality of applications like streaming video and voice-over IP services, as well as other latency-sensitive protocols. Since packet loss can increase the CPU load needed to process additional network overhead there may be some delays and issues.

How Do I Check for Packet Loss?

You can determine whether your network is experiencing packet loss by first performing a ping to identify the issue; you’ll then be able to determine the percentage of packet loss your network is experiencing. Often, there’s no single cause for packet loss, meaning you’ll need to monitor your system’s different processes, like port errors and congestion, to check it for packet loss symptoms.

  • Testing: To test for packet loss inside your network, you can provide extra capacity for links that are receiving more than 90% congestion. Additionally, check your router and CPU’s resources to ensure it’s not an issue with those components within your system. For issues occurring outside of your network, it can often be due to your ISP or another ISP between your path and your destination. In this case, you’ll need to provide your ISP provider with detailed information via a ping/MPR output to resolve the issue.

Reducing Packet Loss

One of the best ways to reduce packet loss is to employ network monitoring software that will monitor capacity and hardware failures throughout your network, alerting you as soon as an issue is perceived. Providing proper network maintenance is another good way to avoid packet loss issues and keep your system running at peak performance levels.

Our Network Monitoring Solutions

As one of today’s leading network and server monitoring companies, Pandora FMS ensures your network is functioning properly.

Remote Network Monitoring: Pandora FMS delivers remote network monitoring without external access via our cutting-edge satellite servers.

Our basic network monitoring features include:

  • Advanced Availability Reports
  • Remote Software & License Inventory
  • Polling SNMP v3 & Complete SNMP Trap Management
  • NetFlow for Network Capacity Management & Low-Level Performance
  • Integrated MIB Explorer, with Custom MIB Loading
  • Auto-Discovery of Networks at Levels 2 & 3
  • Integrated SSH & Telnet Console
  • Historical Graphs for Up to 3Years Back
  • High Availability
  • Integrated IPAM for IP Addressing Management (IPv4/IPv6)
  • Linux & Windows Monitoring
  • & More!

We’re Experts in Complex Networks & Environments

When it comes to working with complicated networks and environments, the team from Pandora FMS are proven experts. Since 2004, we’ve helped clients overcome complex network issues by offering a comprehensive tool and obtaining key insight into their systems.

Our monitoring software is designed to offer users high scalability, adapting as the needs of your business grow. Thanks to our satellite servers and Metaconsole, we enable horizontal growth that is designed to handle thousands of network queries and duties per second. In some cases, our clients operate thousands of network devices and our monitoring solutions help them manage any issue that’s thrown at them.

Contact Pandora FMS for comprehensive monitoring solutions and technology!

If you want to get a handle on your company’s daily operations and improve and secure your network, the team from Pandora FMS would love to tell you more about our offerings. In addition to our network and server monitoring solutions, we offer SAP monitoring capabilities, log collection, and many more services designed to improve your capabilities.

Pandora FMS is committed to helping companies implement horizontal and integrated monitoring, combining key insight from different departments and sources to provide companies with a single dashboard to supervise their technology. We work with clients located in more than 40 countries around the world and have experience working with businesses in any industry, of any size.

We also offer support and training services to ensure a seamless implementation at every level of your business.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.