Cisco ISE configuration for dual authentication

[Romanpreet Singh]

Hello all,

I have a setup where ISE is to be configured to authenticate users to login on network devices (router/switch etc). We need the ISE to perform dual authentication of the user, means username/password (from AD)  and user certificate (NOT machine certificate). Is it possible in ISE then how? (Please no option to use external MFA resource)

[MHM Cisco World]

You can not make this work using only aaa auth login of vty line in ISE as I know.

MHM

[Aref Alsouqi]

Why would you want to do both username/password and certificate authentication? imo it would be enough to use the certificates authentication as that will provide a robust secure authentication method. If you want to add extra security on that, you can integrate ISE with Duo or another 2FA provide, in that case before the users are allowed to the devices they have to pass both certificate and 2FA authentication.

[MHM Cisco World]

The dot1x allow EAP which can make connect between user and ISE' here he access device via telnet/ssh and vty dont have capability to forward eap between user and ISE.

He can use ISE tacacs for command which give him second protection (not auth)  and he can use access-class.

MHM

[Romanpreet Singh]

We are getting away from existing 2FA solution, so to replace that I'm looking for dual authentication option to access network devices on SSH. Do you have any solution to offer other than external 2FA ?

[balaji.bandi]

There was some discussion on this community interesting one - check below (not sure either it was success  ?)

https://community.cisco.com/t5/network-security/cisco-ios-mfa-ssh-certificate-authentication-radius/td-p/4283746

[MHM Cisco World]

That good idea' using internal CA' make admin get cert. Signed by internal CA then make SW or Router revoke Cert. With internal CA.

It work with command @balaji.bandi  provides.

MHM