Have tested using DUO with ISE2.3 and ACS 5.6 for network device access using 2FA. Here are the steps for your reference:
Setup DUO proxy server and add ISE IPs as DUO proxy clients
In ISE, add DUO as a RADIUS Token in Administration > Identity Management > External Identity Sources.
Change Server Timeout value to 30 (or other appropriate value) seconds from default to relax user input timeout under Connection tab, make sure you have the correct DUO proxy server IP address and Shared Secret value entered there. Add the secondary server info if you have HA setup for the DUO proxy servers
Add network admins under Identities > Users and Create an Identity group, such as Net Admin; add all network admin users you created under Identities to the group. Note: make sure that the user you added in pick DUO as the Password Type under Passwords
Create a policy set for network admin access with condition DEVICE: Network Device Profile EQUALS: Cisco, where Cisco includes all your Cisco network devices and this just an example for Cisco. Note: Make sure that you put the new policy set at the bottom of Policy sets if you have multiple policy sets, such as VPN clients, wireless clients, and so on since you do not want to use the same admin user names as other user names, such as AD domain user name.
Authentication Policy: set protocol match condition equal to Radius
Authorization Policy: set Identity group equal to network admin group which you have created above
Configure Cisco device AAA section
Create a Radius server group and add ISE servers under that group
Configure authentication login default group using radius with optional local after radius failed
Configure authorization commands default group using tacacs+ assuming you already have this group with ACS IPs configured.
I have an Active/Passive setup on a couple of Firepower's and my ISP provider is pulling the rug out from underneath me and taking back their CIDR block. As a result, I have acquired a new ISP and have a new CIDR block.
Will the Firepower all...
Hi,Would anyone know if it’s possible to download older versions of Cisco AnyConnect from Cisco directly? For example I’m looking for version 4.5.0.We have an SRX with an old firmware that can’t be upgraded, and there’s a known DHCP addressing bug w...
I have an ISE deployment with 2 PANs and 2 PSNs. Primary PAN, node A, had to be replaced due to hardware failure. node B was promoted temporarily so I can continue to manage ISE. I need to install the wildcard cert back on the new node A...
We are preparing for the Software upgrade path for the FMC4500 and FP8360: Version 18.104.22.168 ->7.0.1.During the same maintenance window, we would like to install BIOS and Firmware Hotfix for FMC Hardware. Please advise if we meet the requirements for...