MFA for switches and routers

[manvik]

Has anyone done MFA for Network switches and routers without DUO push. Usually routers and switches does not have option to enter SMS passcodes received.

[CK3510]

I have not done this yet, but could you use the password,duocode from your DUO app? I would think this would work with the Duo Proxy set up as your radius server.

[manvik]

thank you, that requires a smart phone. user has simple phone, not android or iphone.

[DuoPablo]

Hi @duorunner1 ,

If you integrate your network device(s) with Duo via RADIUS, you might be able to do this via Append Mode (concatenation): Duo Two-Factor Authentication with RADIUS and Primary Authentication | Duo Security.

Please note that Append Mode (which is required if you wish to specify SMS as an authn method) cannot be used if your RADIUS server is configured with MS-CHAPv2 or EAP-MSCHAPv2 as described here: https://help.duo.com/s/article/2084?language=en_US. Otherwise, the Auto Mode method is performed, which uses either Duo Push or Phone Call as the authn method.

Hope this helps!

[Ah15]

Hello,

Could you advise how to use Duo MFA with switches that use local users while using ssh access?
not using radius or ldap

[manvik]

if you are using DUO MFA with switch, your radius server will be DUO. For the switch the authentication or radius server is set as DUO, only then auth requests goes to Duo.

[Ah15]

duorunner1:

your radius server will be DUO

So we need to add a [radius_client] section to auth proxy file, and configure the details for it (Host= the IP of the SW) ??
And a configuration on the switch for a radius: ##radius-server host (IP of the auth proxy) auth-port 1812 key xxxxx

[manvik]

yes, that’s correct.

[manvik]

Duo call back could be an option.