Product manual

45
whichever is lowest
SMS Credits
less than 10 SMS credits
remaining (Onboarding +
Top-up)
0 SMS credits
remain
Never
Never
Never
12.2.4 License Enforcement
The following table describes how license enforcement is performed on the ESA authentication server. In all cases, an
administrator will be able to disable ESA authentication for a subset of the users (by disabling 2FA for those users) or for all
users (by means of system configuration or uninstalling the product).
OK
Warning
SMS Credits
depleted
Violation (full
functionality)
Violation (limited
functionality)
ESA Disabled
Enable Users for
2FA
Allowed
Allowed
Allowed
Allowed
Disabled
Disabled
Provision Users
Allowed
Allowed
Disabled
Allowed
Disabled
Disabled
Authenticate with
SMS OTP
Allowed
Allowed
Disabled
Allowed
Allowed
Disabled
Authenticate with
mobile app
Allowed
Allowed
Allowed
Allowed
Allowed
Disabled
Authenticate with
hard token
Allowed
Allowed
Allowed
Allowed
Allowed
Disabled
Manage system
configuration
Allowed
Allowed
Allowed
Allowed
Allowed
Allowed
Disable Users for
2FA
Allowed
Allowed
Allowed
Allowed
Allowed
Allowed
13. High Availability View
All installed servers are displayed in the “servers” panel of the ESA management console. When more than one core service is
detected on the network, all servers are displayed. Online and active servers are shown in green , and offline servers are shown in
red.
Each ESA Authentication Service that gets installed on the domain registers itself in AD DNS using an SRV record (as
_esetsecauth._tcp). When an endpoint (such as a web application or a VPN appliance) begins authentication, it first checks its
internal list of known servers. If the list is empty, it performs an SRV lookup. The SRV lookup will return all Authentication Servers
on the domain. The endpoint then chooses an Authentication Server to connect to. If the connection fails, it selects another server
from the list and attempts to connect again.
If network redundancy is a concern when protecting your VPN with ESA, it is recommended to configure primary and secondary
RADIUS authenticators on your VPN appliance. You should then install two ESA RADIUS servers on your network, and configure
them accordingly.