Configuring ISE 2.4 with TACACS+ to use token and PIN for AAA

[rllesh1]

I have been tasked to find a solution.  We have a Cisco ISE 2.4 server.  We are using it for TACACS+ to do our AAA against Active Directory using a username and password.  We would like to use a CAC badge (token) to authenticate against AD with the PIN on the CAC.  Suggestions in how to set this up?

Thanks.

Robert

[Mike.Cifelli · Accepted solution]

So there are a couple of different ways to implement this. If you are running an IOS version below 15.2.4 you will need to store the public key locally on your NADs for each user profile you setup. The better way to do it is documented here: https://www.pragmasys.com/products/support/cisco-2-factor

With that said, you will need third party software. I have used pragma for 2+ years now with that solution and it works like a charm. Good luck!

[kthiruve · Accepted solution]

Please check out the community page for ISE and 2 factor authentication. It has links for CAC and for other 2FA.

https://community.cisco.com/t5/security-documents/two-factor-authentication-on-ise-2fa-on-ise/ta-p/3636120

-Krishnan