topic Re: ISE Admin Login 2FA in Network Access Control

ISE Admin Login 2FA

Steven Williams — Wed, 29 Aug 2018 15:57:13 GMT

Can you enable DUO auth within a policy for ISE admin login on the landing ISE page?

Re: ISE Admin Login 2FA

thomas — Wed, 29 Aug 2018 17:49:27 GMT

Please do Search the community for existing answers before posting questions.

Re: ISE Admin Login 2FA

hslai — Sat, 01 Sep 2018 22:44:14 GMT

Yes, this should work.

Administrative Access to Cisco ISE Using an External Identity Store says,

...

External Authentication and Internal Authorization—The administrator’s authentication credentials come from the external identity source, and authorization and administrator role assignment take place using the local Cisco ISE database. This model is used for RSA SecurID authentication. This method requires you to configure the same username in both the external identity store and the local Cisco ISE database.

...

Configure Admin Access Using an External Identity Store for Authentication with Internal Authorization

...

As DUO is a RADIUS token ID source similar to RSA SecurID, we would follow the same mode and need creating internal admin users with the same usernames as those on DUO.

Re: ISE Admin Login 2FA

Christopher Bell — Wed, 19 Jun 2019 17:48:43 GMT

Very unhelpful answer given that both of the links address something different than what he asked for.