Machine auth with aaa and secondary auth

[Stuart-ITGL]

Does anyone know if it is possible to set up an Anyconnect tunnel such that it uses Machine Authentication (from a cert) as well as querying a RADIUS server for the primary authentication with RSA SecurID used a the Secondary method?

Essentially want to tie down connections to domain registered devices in addition to the use of AAA and 2FA

TIA

[Rob Ingram]

Hi,
Yes this is possible. You can configure double authentication (aaa and certificate). The client certificate will be authenticated against the certificate on the ASA. It will also send another authentication request to the RADIUS server.

HTH