2FA for ISE Administration Access

[biswajit.pradhan]

We want to have two factor for ISE administration with authorization based on AD group membership. Is there any config guide available?

[Mark Elsen]

 - Check this thread :

           https://community.cisco.com/t5/network-access-control/ise-admin-login-2fa/m-p/3876233

  M.

[biswajit.pradhan]

Does this means, if I'm having any external radius for authentication then can't have AD for authorization? 

[thomas · Accepted solution]

You may still use Active Directory for the identity store however, due to the 2FA/MFA requirement, it will not be ISE that does the authentication with AD. Instead, ISE will do a RADIUS proxy to the 2FA/MFA vendor (Cisco Duo?) and they will perform the initial AD Authentication followed by the second factor push/token/whatever.

See https://cs.co/ise-guides > Cisco Duo Security for guides and videos.

[balaji.bandi]

how about below guide :

https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/admin_guide/b_ise_admin_guide_26/b_ise_admin_guide_26_chapter_01110.html