Cisco ISE Two-factor authentication Need Help

[uzair.infotech]

Hi,

Our customer is operating Cisco ISE Version: 2.3.0.298 with Base license. Client want to implement Two-factor authentication with RSA Secure ID.

Please help whether client is required to upgrade the license or Cisco ISE Base license will support the Two-factor authentication.

[Mike.Cifelli · Accepted solution]

So base licenses will cover the following:
Network access: AAA, 8021x, etc.
Guest Management
MACsec
Trustsec
ISE APIs

I assume your client wants to implement 2-factor for device administration. If that is the case you will need Device Administration licenses which support the use of TACACS+ for 2FA. If your use case is something different this may better assist you:
https://community.rsa.com/docs/DOC-66799

HTH!

[uzair.infotech]

Thank you Mike.

My client want to use 2-factor authentication for LAN users not for device administration.

[Mike.Cifelli]

No problem. For your case you may want to consider looking into using Anyconnect NAM with EAP-GTC.