Hey guys-
We are starting to stand up ACS 5.6 into our network for network access. When a user initially logs in, ACS will make a RADIUS call out to CyberArk/SecureNet (cloud based two-factor) and then receive a token, which the user uses to login.
A question comes to mind, looking for some recommendations/suggestions.
With ACS, how can we handle service accounts? Service accounts such as Cisco Prime and Orion Monitoring, which are appliances used to search the network. These accounts cannot obtain a token obviously, so is there a way to setup ACS to enforce something like this on network devices (mainly IOS/NX-OS):
- If a regular user - authenticate via SecureNet
- If a service account - utilize X to login (something to avoid having to get a token)
