Could you give some information about how you have set this up, and the authentication traffic flow?
Ideally the FTD should be authenticating to the ISE, and the ISE is using DUO authentication proxy, and DUO will be authenticating the username / password against the AD server and as well as send OTP before returning a verdict to ISE.
--
Please remember to select a correct answer and rate helpful posts