I didn't realize that Cisco ASAs will only send login credentials via PAP to Windows Radius Servers for admin users? From what I can find, MS-CHAP v2 is only supported for tunnel/VPN users? I was hoping to use Cisco Duo to implement MFA for a variety of network devices from mixed vendors.
Most of the other products I have are (relatively) easy to setup to send encrypted user credentials to the NPS server via my Cisco Duo proxy. The device admins use their Duo app to confirm their identity. In my ASAs (and other supported Cisco devices) it looks like I'd have to use ISE if I wanted to implement true MFA?
