Posture authorization with ISE and MFA with DUO

[trcolber]

If DUO is configured as a Radius token server in ISE and handles the initial MFA, is it possible to do posture in authorization against ISE?

[hslai]

With a RADIUS token server that providing OTP, I would expect it to prompt again during the re-authentication after CoA triggered by posture compliance. With MFA such as Duo, one needs to take care that all factors by the RADIUS server completed within the RADIUS server timeout, which at most 120 seconds. Other than that, it should work.