Assume we configure ISE as the Primary and Duo as the secondary auth, which would function more like an OTP server than a Proxy. The questions I have are 1) would ISE be able to pass radius attributes to the client with Duo as the secondary and 2) does this method dilute Duo’s functionality (where ISE does not have the capability to substitute)?
In this image from Duo, ISE would be the Primary Authentication via RADIUS:
