pfSense » pfSense Packages

Currently, Radius+OTP requires the user to add the PIN+OTP in the password field every time the user connects. With the static-challenge option(https://openvpn.net/as-docs/tutorials/tutorial--challenge-response-authentication.html#step-3--set-up-a-static-challenge-response), the client can save PIN as the password and add OTP in a separate window. However, the Radius expects to see the password as password=PIN+OTP, to workaround it, the following can be added to the Radius config (this likely should be the GUI option):

if (&request:State) {
    update request {
        User-Password := "%{User-Password}%{reply:Reply-Message}" 
    }
}