The section on enabling TACACS+ accounting on IOS is missing. (See page 17, step 3.) Looks like when this document was updated from the one here How To: ISE TACACS+ Configuration for IOS Network Devices the "TACACS+ Command Accounting" section was accidently dropped. The other How To TACACS+ document also had some nice screenshots of the TACACS Livelog that would be nice to see in this guide as well.
... View more
Assume we configure ISE as the Primary and Duo as the secondary auth, which would function more like an OTP server than a Proxy. The questions I have are 1) would ISE be able to pass radius attributes to the client with Duo as the secondary and 2) does this method dilute Duo’s functionality (where ISE does not have the capability to substitute)? In this image from Duo, ISE would be the Primary Authentication via RADIUS:
... View more
.jpg "Hall of Fame Guru"){kind=icon}
