---
title: MFA Configurations for VPN Services
slug: kronpam-reference-guide-3-9-0/mfa-configurations-for-vpn-services
description: Learn how Kron PAM MFA can serve as a third-party MFA server, offering primary and secondary authentication options for applications, devices, VPNs, and more. Discover the step-by-step process of activating each feature, including defining user groups and
docTags: 
createdAt: 2022-07-31T18:23:34.000Z
---

Kron PAM MFA can be used as a 3rd party MFA server for all applications, devices, VPNs, etc. that support RADIUS authentication. Two options are available for MFA server support:

1. Both the first authentication (with username and password) and the secondary authentication (with OTP) are provided via Kron PAM. To activate this feature:
   - Define the VPN device according to the TACACS Access Manager configuration.
   - Enable MFA on the User Group (Navigate to** Administration** >** MFA **> **User Group Management**)
2. Only a secondary authentication with OTP can also be provided via Kron PAM. To activate this feature:
   - Define the VPN device and the Device Group Realm with the related users in Kron PAM (See [User Group Creation](docId\:ukTcHfJa7qMMpAqas-IiJ) and [Device Management](docId\:w5aax5p91PY2EE-PHUHCo)  sections.)
   - Enter the element type property in the VPN Device element type section:
     1. Navigate to **Device **>** Element Type**.
     2. Select the **Element Type, **then proceed by clicking the **Actions **button (green arrow)
     3. Click **Edit Element Type.**
     4. Select **Authentication Device** as an **Association Tag** and proceed with the **Next** button.
     5. Expand the RADIUS – TACACS menu on screen.
     6. Switch the **Radius Auth Only Token Enabled** parameter to ON

::Image[]{src="https://app.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/SmyLnsbHRlp2zFY1JJXOw_image.png" size="72" width="623" height="868" position="center" showCaption="false"}