ISE and VPN with 2 factor

[shaunwhi]

customer has an ASA VPN setup with two auth methods, initial UN/PWD then two factor…they want to know if ISE will still be able to work and do dACL push based on specific AD attributes if they have the two methods of AUTH enabled on the ASA, I couldn’t find that anywhere

[hslai]

I am no expert on ASA multi authentications, but I believe you would likely need ISE to proxy the 2nd auth (OTP) and then have ISE performing the AD lookups.