topic Re: 2FA for ISE Administration Access in Network Access Control

2FA for ISE Administration Access

biswajit.pradhan — Thu, 24 Sep 2020 12:17:10 GMT

We want to have two factor for ISE administration with authorization based on AD group membership. Is there any config guide available?

Re: 2FA for ISE Administration Access

Mark Elsen — Thu, 24 Sep 2020 12:23:43 GMT

- Check this thread :

https://community.cisco.com/t5/network-access-control/ise-admin-login-2fa/m-p/3876233

Re: 2FA for ISE Administration Access

balaji.bandi — Thu, 24 Sep 2020 12:32:03 GMT

how about below guide :

https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/admin_guide/b_ise_admin_guide_26/b_ise_admin_guide_26_chapter_01110.html

Re: 2FA for ISE Administration Access

biswajit.pradhan — Thu, 24 Sep 2020 15:17:08 GMT

Does this means, if I'm having any external radius for authentication then can't have AD for authorization?

Re: 2FA for ISE Administration Access

thomas — Thu, 24 Sep 2020 18:34:57 GMT

You may still use Active Directory for the identity store however, due to the 2FA/MFA requirement, it will not be ISE that does the authentication with AD. Instead, ISE will do a RADIUS proxy to the 2FA/MFA vendor (Cisco Duo?) and they will perform the initial AD Authentication followed by the second factor push/token/whatever.

See https://cs.co/ise-guides > Cisco Duo Security for guides and videos.