X.09 Two Factor on Red interface

[Guest]

[fackler]

Ok, we have an EFW UTM 2.3.  We have the Two Factor Authentication, X.509, VPN working on the Green and Orange interfaces. 
AKA: if the OpenVPN client is coming from the Green or the Orange zones, then X.509 works.  But on the Red zone, we can only get psk to work.  Is there something different about the Red interface we are not taking into account? 

We have gotten the same behavior on two different test hardware setups for EFW.  This is why I am thinking there may be a configuration option or setting for the Red zone that is not readily apparent or documented.