topic Re: MFA integration with cisco ISE in Network Access Control

MFA integration with cisco ISE

Alexander Callum — Wed, 25 Sep 2024 12:50:50 GMT

The goal is for the second of authentication factor to be required.
I've been trying to figure out for some time if there is a solution that would allow us to meet these requirements, I would be grateful if someone could help me.

Re: MFA integration with cisco ISE

ahollifield — Tue, 17 Sep 2024 15:51:45 GMT

Native DUO in 3.3+?

Re: MFA integration with cisco ISE

Alexander Callum — Tue, 17 Sep 2024 15:57:50 GMT

does not meet all the requirements including session caching and MFA for SSH. In addition, 3.3+ is a beta and not an official product.

Re: MFA integration with cisco ISE

ahollifield — Tue, 17 Sep 2024 16:04:07 GMT

What? MFA for SSH is certainly supported.... via TACACS+..... 3.3 is not a beta. 3.4 is also not a beta release? What do you mean?

Re: MFA integration with cisco ISE

Alexander Callum — Wed, 18 Sep 2024 13:26:34 GMT

I didn't mean that mfa for ssh is not supported, but I can't understand how the session cahing mechanism can work with ssh,

Re: MFA integration with cisco ISE

thomas — Thu, 26 Sep 2024 22:21:49 GMT

You didn't give any specific requirements for your MFA solution in your original post. Please be very specific in your future requests to save everyone a lot of time.

https://duckduckgo.com/?t=ffab&q=ise+mfa+integration gives you many, many answers and options to try. I also did a webinar about it: ▷ ISE & Duo Integration for MFA 2024-01-09. Search the ISE BERG for "mfa" for options, too.

ISE 3.3 has been released for over a year and 3.4 has been released for months. See https://cs.co/ise-software.

Whatever sources of information you have been using are incredibly inaccurate. Please use the following authoritative sources:

🥇 ISE BERG (Big Encyclopedic Resource Guide) (https://cs.co/ise-berg)
ISE Webinars (https://cs.co/ise-webinars) : First week of every month!
ISE YouTube Channel: (https://cs.co/ise-youtube) : ISE Webinar archive and more!
ISE Training (https://cs.co/ise-training) : YouTube, Cisco Live, and more!
ISE Bar Public Webex Space (http://cs.co/ise-bar) Public means Customers, Competitors... Anyone.

Re: MFA integration with cisco ISE

JPavonM — Mon, 30 Sep 2024 09:25:30 GMT

Cisco ISE with MFA (DUO or Token server with MS NPS) provides a caching mechanism that can be manually set so to avoid admin users from continnuosly approving the MFA push notification (ir validation code) if they access to network devices consecutively.
This is something that an be enabled or disabled as you wish:

By the way, take care of configuring 2FA for GUI interfaces as they don't use to support TOTP but only push notifications. (Cisco WLC GUI, Palo Alto, F5, ...)

Re: MFA integration with cisco ISE

jepema — Wed, 16 Apr 2025 13:16:27 GMT

Hi,

I know this is a rather old post, but does anyone have some screenshots or documentation you can share about using Cisco ISE together with Microsoft NPS for device admin access? We've tried the setup below but it does not work as expected (yet).

The Microsoft NPS is configured as a RADIUS Token and set to use as Identity Store underneath Allowed Protocols in the AuthN section of the Policy Set. The AuthZ section contains only some AD groups as Condition. The problem we have is the userid/password check; even with a wrong password we get a MFA.

Any idea or suggestion would be much appreciated.