I've been looking at Network Manager and now looking at StrongSwan. Although StrongSwan seems to support challenge-response, it seems it only does so on the server side.
Whereas vpnc/NetworkManager doesn't support it at all:
https://bugzilla.gnome.org/show_bug.cgi?id=751842
So far my options seem to be:
- forget it and use client-side certificates, managing them manually
- buy a Cisco or Juniper VPN concentrator, even though we're already using a Palo Alto
Surely there's another option?
Searching on strongswan and challenge-response, the only options seem to be server-side. But no 2FA challenge-response clients.