Can we Integrate ISE with Yubikey MFA for Device Administrator

[hashimwajid1]

Hi, 

we want to integrate Yubikey MFA solution with Cisco ISE for Device administration (SSH with Tacacs).  is there any way that we can achieve this by using Yubikey.

currently Yubikey MFA is being use for windows login in enviornment but now customer want it for device ssh authentication as well 

is there any way that we can achieve Switches and Routers Authentication by using Yubikey.

Thanks in Advance

[Surendra · Accepted solution]

I am not an expert on Yubikey by any means but I don't think Yubikey is applicable for device administration to start with since it is a hardware token AFAIK. Here is the link for the Yubikey catalog where device administration is not an option at all https://www.yubico.com/works-with-yubikey/catalog/#key=all&usecase=all 

[hashimwajid1]

Hi Surendra,

Thanks for your quick response,

can you confirm which will work fine with ISE
GMALTO or DUO mfa with ISE for Device Administration ?

Regards

[Jason Kunst · Accepted solution]

Correct, if it works similar to other solutions you might be able to utilize it. I would recommend reaching out to them to see how it may work and also use the example belows to help guide you

https://community.cisco.com/t5/security-documents/two-factor-authentication-on-ise-2fa-on-ise/ta-p/3636120
https://community.cisco.com/t5/security-documents/using-duo-with-ise-2-3-and-acs-5-x-for-2fa-cisco-network-admin/ta-p/3642171