Hi All!
I have a question related to Cisco ISE and Cisco DUO native integration. As I know, from ISE 3.3 patch 1 it is possible to implement native integration with DUO. From this document:
https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-33/221232-configure-ise-3-3-native-multi-factor-au.html
I see section about limitation, but from my perspective only this is necessary info:
"Only the following multifactor authentication use cases are supported:
- VPN user authentication
- TACACS+ admin access authentication"
At this point, I using Cisco ISE as a RADIUS server for authentication (AAA) to my all switches (I don't have TACACS license).
Looking on the limitations for ISE and DUO integration, in theory, it is not possible to use DUO as a MFA during authentication to switches, but it is little strange because on the inside authentication for VPN it is also RADIUS (ASA->ISE).
Question is: Is it possible to do configuration using native integration between ISE and DUO to use it for authentication to switches ? If not, why ? so why for VPN is working but for AAA to switches no ?
