Have tested using DUO with ISE2.3 and ACS 5.6 for network device access using 2FA. Here are the steps for your reference:
Setup DUO proxy server and add ISE IPs as DUO proxy clients
In ISE, add DUO as a RADIUS Token in Administration > Identity Management > External Identity Sources.
Change Server Timeout value to 30 (or other appropriate value) seconds from default to relax user input timeout under Connection tab, make sure you have the correct DUO proxy server IP address and Shared Secret value entered there. Add the secondary server info if you have HA setup for the DUO proxy servers
Add network admins under Identities > Users and Create an Identity group, such as Net Admin; add all network admin users you created under Identities to the group. Note: make sure that the user you added in pick DUO as the Password Type under Passwords
Create a policy set for network admin access with condition DEVICE: Network Device Profile EQUALS: Cisco, where Cisco includes all your Cisco network devices and this just an example for Cisco. Note: Make sure that you put the new policy set at the bottom of Policy sets if you have multiple policy sets, such as VPN clients, wireless clients, and so on since you do not want to use the same admin user names as other user names, such as AD domain user name.
Authentication Policy: set protocol match condition equal to Radius
Authorization Policy: set Identity group equal to network admin group which you have created above
Configure Cisco device AAA section
Create a Radius server group and add ISE servers under that group
Configure authentication login default group using radius with optional local after radius failed
Configure authorization commands default group using tacacs+ assuming you already have this group with ACS IPs configured.