Does Duo officially support MikroTik?

We found no MikroTik integration in Duo’s documentation. The generic RADIUS integration through the Duo Authentication Proxy applies, as it does to any RADIUS client, with the same timeout considerations.

Which MikroTik VPN types does the Notakey script cover?

PPP-based VPNs: L2TP/IPsec, PPTP and SSTP, on RouterOS 6.46.4 or newer including 7.x.

What is the most common mistake on MikroTik?

Leaving the RADIUS timeout at its 300-millisecond default. Set timeout=30s (Notakey) or at least 60 seconds (Duo) on the /radius entry, or every login fails before the phone buzzes.

Comparison · Cisco Duo

A Duo alternative for MikroTik: 2FA without a RADIUS server

For MikroTik administrators who searched for Duo and found only a generic RADIUS page. This is what each option takes on RouterOS, and when the generic path is still the right one.

Request a demo Try the live demo

The short version

We found no MikroTik integration in Duo’s documentation. RouterOS can still send logins to the Duo Authentication Proxy over RADIUS, because the proxy acts as a RADIUS server, but that means a Windows Server or Linux host for the proxy, normally with Active Directory or a RADIUS server behind it for the password check, and raising MikroTik’s 300-millisecond RADIUS timeout to a minute.

Notakey has two documented MikroTik paths. For PPP-based VPNs (L2TP/IPsec, PPTP, SSTP) a RouterOS script asks the Notakey server for the approval and the firewall holds the session until the user taps Approve: no RADIUS server, no proxy host. For WinBox, WebFig and SSH logins, the Notakey auth-proxy sits in the RADIUS path like Duo’s would. The cloud tier is free for the first 6 users, the on-premise appliance for the first 10.

Vendor facts checked on 13 October 2026. Prices are the vendors’ published list prices on that date and change without notice.

Aspect

Notakey

Cisco Duo

VPN 2FA on RouterOS: NotakeyRouterOS scripts from the notakey/mikrotik-2fa-vpn repository (RouterOS 6.46.4 or newer, including 7.x); the firewall blocks the session until the phone approval arrives. No RADIUS server.; Cisco DuoGeneric RADIUS: the Duo Authentication Proxy is the router’s RADIUS server and sends an automatic push after the primary login. We found no vendor guide for MikroTik.
Router login (WinBox, WebFig, SSH): NotakeyThe auth-proxy in the RADIUS path, with timeout=30s on the /radius entry and use-radius under /user aaa. Documented step by step.; Cisco DuoSame RADIUS mechanism through the Duo proxy; Duo recommends a 60-second client timeout.
What you have to run: NotakeyA Notakey cloud instance, or the appliance VM on-premise. The script path needs nothing else. For router logins over RADIUS, the proxy is built into the appliance; with a cloud instance it runs as a container, or with the MSI installer on Windows, on a host in your network.; Cisco DuoA Windows Server 2016+ or Linux host for the Authentication Proxy, usually with Active Directory or a RADIUS server behind it for the password check, plus the Duo cloud account.
Pricing (list, per user per month): NotakeyCloud: first 6 users free, then €2.50. On-premise: first 10 users free, then €0.80.; Cisco DuoFree up to 10 users; then $3 to $9 depending on edition, in increments of 10 licences under 100 users.
What the user sees: NotakeyAn approval card with the service name, username and the IP address the request came from, and a countdown. A card for a login they did not start gets denied.; Cisco DuoA Duo Push, or a phone call, sent automatically after the primary login. Verified Duo Push needs a screen that shows the code, such as Duo’s Windows Logon prompt; Duo’s RADIUS documentation does not mention it.
Beyond MikroTik: NotakeyDocumented setups for FortiGate, Palo Alto GlobalProtect, Linux SSH, Windows Remote Desktop, WordPress and legacy web apps, plus transaction signing.; Cisco DuoA much larger catalogue of SaaS and vendor integrations, device trust and SSO.

Stay with Duo if

You already run Duo for other systems and have the Authentication Proxy host in place; adding the router as one more RADIUS client is a small step.
You need Duo’s SaaS integrations, device trust or passkeys elsewhere in the organisation.

Pick Notakey if

You have a single MikroTik router and no RADIUS infrastructure, and want VPN 2FA quickly.
Authentication should stay on your own appliance, or the router is at a site without a Windows or Linux server to spare (the script path needs none; router logins over RADIUS still need a host for the proxy with a cloud instance).
You want the admin plane (WinBox, WebFig, SSH) and the VPN behind the same app and approval, both documented step by step.

What Notakey does not do

The documented MikroTik VPN setups (script or RADIUS) cover PPP-based VPNs: L2TP/IPsec, PPTP and SSTP. Other tunnel types, such as WireGuard, are not covered.
The script’s JSON parser cannot handle parentheses and some other punctuation in the approval message; keep it plain.
No device trust, no passkeys, no SaaS catalogue.

Frequently asked questions

Does Duo officially support MikroTik?: We found no MikroTik integration in Duo’s documentation. The generic RADIUS integration through the Duo Authentication Proxy applies, as it does to any RADIUS client, with the same timeout considerations.
Which MikroTik VPN types does the Notakey script cover?: PPP-based VPNs: L2TP/IPsec, PPTP and SSTP, on RouterOS 6.46.4 or newer including 7.x.
What is the most common mistake on MikroTik?: Leaving the RADIUS timeout at its 300-millisecond default. Set timeout=30s (Notakey) or at least 60 seconds (Duo) on the /radius entry, or every login fails before the phone buzzes.

Sources

Product names are trademarks of their owners and are used only to identify the products compared.

← All comparisons

A Duo alternative for MikroTik: 2FA without a RADIUS server

See your first passwordless login this week