Recluda | VPN administrator guide

How to make Recluda the second factor for your organization's VPN, set people up, and use the VPN tab in the app.

How it works

Your VPN already has a sign-in. Recluda plugs in as a RADIUS server, so after the username (and password, if you connect a directory) the person approves on their phone:

They connect in their VPN app with their username and password.
The VPN asks Recluda over RADIUS, and shows a message: "Open Recluda, enter code 7QK-4MX and tap 47. Then press Enter here." Where push notifications are set up, Recluda also notifies that person's phone.
They tap the notification (or open Recluda and enter the code), tap that number among the three Recluda offers, then Face ID or Touch ID.
They press Enter (or OK) in the VPN app. Recluda answers the VPN Accept; a wrong number, a denial or no answer in time is a Reject.

Each VPN username belongs to one person, and only that person's devices can approve its sign-ins.

What you need

A VPN that supports RADIUS with PAP and a challenge message (RADIUS Access-Challenge), so it can show the number: for example Cisco AnyConnect (ASA or FTD), FortiGate / FortiClient, Palo Alto GlobalProtect or OpenVPN. A VPN that only waits for an Accept can't show the number, so it can't be used.
The Recluda sign-in server with its RADIUS bridge running, reachable from the VPN on UDP 1812 (authentication). UDP 1813 (accounting) is acknowledged and ignored.
An administrator account: you sign in to the admin console with the admin password and Recluda. The first account to approve the admin console is its administrator.
People's phones with Recluda and Face ID or Touch ID set up. With notifications allowed, the sign-in comes to them as a notification; otherwise they enter the code the VPN shows.

1. Get the RADIUS settings

Two places show the same three values:

In the admin console (on the server's network, port 5004): VPN → VPN Settings: Server, Port and Shared secret (click Show).

In the Recluda app, on an administrator's iPhone, iPad or Mac:

Open VPN in the bottom bar.
Under For administrators, tap Show the VPN settings and confirm with Face ID or Touch ID.
Recluda shows Server, Port (UDP), Shared secret and Protocol, each with a copy button.

The secret is only shown to administrator accounts, with a fresh biometric signature, and it's hidden again when you close the screen. If it doesn't appear, see Troubleshooting.

2. Add Recluda to your VPN as a RADIUS server

In your VPN's settings, add a RADIUS (or AAA) server with:

Setting	Value
Server address	the Server from step 1
Authentication port	1812, UDP
Shared secret	the Shared secret from step 1
Authentication method	PAP
Timeout	60 seconds or more (Recluda waits up to 60 s for the approval; a shorter VPN timeout rejects people who are still reaching for their phone)
Challenge / "RADIUS challenge" / "Access-Challenge"	on, if your VPN has the option
Accounting	optional; Recluda acknowledges it and ignores it

Then make that RADIUS server the authentication for the VPN profile or connection your people use. The names differ by product; look for "AAA server group" (Cisco), "RADIUS server" and "PAP" (FortiGate), or "RADIUS server profile" with "Authentication protocol: PAP" (GlobalProtect).

Passwords. If your Recluda server is connected to your directory (LDAP), the password is checked against it first, then Recluda asks for approval: the usual "password, then phone". Without a directory, Recluda's approval is the only check and the password field is ignored.

3. Set people up

A new person (they get a setup QR):

In the admin console, open VPN → Set Up a Person.
Enter their VPN username and click Make setup QR.
They open Recluda and tap Scan (or point the iPhone camera at the QR), then LINK. Or they tap Link and type the code shown under the QR.

The code is shown once and is valid for 24 hours. If the username already belongs to someone, the QR adds another device to that person instead.

Someone who already uses Recluda: in VPN → People, type their VPN username next to their account and click Save.

In the People table, ● in teal next to a device means it can receive pushes; a grey ● means it hasn't sent a push token yet (open Recluda on it and allow notifications).

4. Test it

Sign in to the VPN as a set-up person.
The VPN should show "Open Recluda, enter code XXX-XXX and tap NN. Then press Enter here.", and with push notifications set up, the phone gets one.
Tap the notification (or enter the code in Recluda), the number, then Face ID or Touch ID, then Enter in the VPN.
The sign-in appears under VPN → Recent VPN Sign-ins in the admin console (Approved, Denied, Expired or Pending), and in the app under VPN → Recent VPN sign-ins on that person's device.

The VPN tab in the app

Everyone sees:

Your VPN username: the username their administrator linked to their account, or "Not set up yet".
Signing in to the VPN: the four steps above.
Recent VPN sign-ins: the last few they approved or denied, from the history on that device.

Administrators also use For administrators → Show the VPN settings (step 1).

Troubleshooting

What you see	What it means
The app says "Not set up yet"	No VPN username is linked to this account. Set the person up (step 3).
"These settings are for administrators."	The device's account isn't an admin of the admin console.
"This device isn't registered with the sign-in server yet."	Approve one sign-in on it first, or link it with a setup QR.
"The VPN isn't set up on the sign-in server yet."	The RADIUS bridge has no settings on the server.
"Cancelled."	Face ID or Touch ID was cancelled; try again.
The VPN rejects at once	The username isn't linked to anyone, the directory password was wrong, or the VPN can't reach UDP 1812 or has a different shared secret.
No push arrives	Enter the code the VPN shows in Recluda instead. For notifications: the device needs a teal ● (open Recluda and allow notifications), and the server needs push set up.
The VPN times out while they approve	Raise the VPN's RADIUS timeout to 60 seconds or more.
"That username belongs to someone else." (admin console)	Each username is one person's; remove it from the other account first.
The number is never shown	The VPN doesn't support RADIUS challenge messages, or the option is off.

Security notes

The shared secret is shown only to administrators, after Face ID or Touch ID, and only on request. Treat it like a password; if it's exposed, change it on the server and in the VPN together.
The match number is never sent to the phone; people read it from the VPN.
Sign-in records (username, result, time) stay on your Recluda server.