TACACS+ Authentication not Working for MFA using Radius Server Sequence

[kkaminsk]

Folks,

Question from a very large Insurance customer: 

I am  not able to send Tacacs authentications over to a Radius Server Sequence,  only an “External Identity Source’ using ISE 2.3. Is this the only supported behavior for TACACS+ authentications?  The solution works for Cisco ACS 5 as a Radius server proxy.  It uses a one time token for multi-factor authentication.

Is this only supported as an External Identity Source?

[hslai]

It seems the customer might be hitting CSCvg03448, which is resolved in ISE 2.3 Patch 2.

Otherwise, T+ in ISE does support external RADIUS servers.