Abstract: A user can authenticate with multiple factors to a security appliance and establish an authenticated connection with a TN3270 client to a TN3270 server on a first mainframe via the security appliance as a proxy. The security appliance records the port number of the proxied connection and associates the port number with the user identifier, as well as an indication that MFA was performed successfully. After an SNA session is established with a second mainframe that hosts the SNA application to be accessed, a security macro can resolve a logical unit name of the TN3270 client to the IP address of the security appliance and port number of the proxied connection. The second mainframe can send a request via a web interface to the IP address for verification that the MFA requirement was satisfied for the user identifier associated with the SNA session.