If you think about how the authentication flow works, you'll come down to a few different options:
If you're logging into network equipment using local users on this equipment, then that equipment needs to have built-in support for additional 2FA/MFA in order to attach any kind of MFA to the authentication process.
This is almost never the case, rare exceptions apply.
In order to involve external MFA solution like DUO, you need to be able to ask an external source.
While technically speaking, you could get creative with local users and external authorization flow, but the most common setup is to have a centralized identity store (for example, AD), and you authenticate to that via RADIUS or LDAP(s).
For GUI authentications only, you could also use SAML and DUO SSO.
So typically you would be using RADIUS or LDAP from the switch or firewall to the DUO auth proxy, authenticate against something (AD), and if that authentication succeeds, an additional factor (DUO PUSH) is applied.
One thing to keep in mind is to extend the authentication timeout to allow the end-user/admin to go through the MFA process.
So to answer your initial question, you can use DUO for practically anything and any vendor, as long as your authentication process involves RADIUS, LDAP, or SAML.
On a practical note, however, you could also base your design on a trusted bastion/jump host, have MFA towards that host, but not from the host to the network equipment.
In the environments that I've seen implementing MFA directly towards management on network equipment, it often ends up with multiple exceptions because of automation, script usage, or other use-cases, creating a false sense of security around MFA usage on network management.
