Android Phone not getting right gateway information

[aosterlund22]

Hello,
We are trialing Defguard as a possible VPN replacement for our networks. We have a trail proxy, gateway, and core server stood up. The Core and Proxy server are using certbot to get a trusted cert for cell phones.

I am able to enroll Windows Desktop computers, and they pickup on the external MFA functionality using Entra as the identity provider with conditional access for MFA.

A cell phone will provision off of the proxy server, but it defaults to "internal MFA", and never moves to "external MFA". If I turn off the MFA requirements, or switch it to "internal MFA" the cell phone also never successfully connects to the wireguard VPN.

[teon]

@aosterlund22 what do you mean that proxy defaults to Internal MFA? If you configured proxy & EntraID when going to proxy in the browser you should have a process where you login by Entra and then you can just scan QR code on the mobile.
Then when you connect to location protected by External MFA on mobile when connecting you should have a web page with proxy opened to authenticate on Entra...

[aosterlund22]

It looks like my conditional access policy in Entra was the hang up. Thanks for the help.