Cisco ACS. Two-factor authenticaion.

[Raketckii]

Hello.

We intend to use scheme of connection: cisco asa + cisco acs 5.4 + rsa securid.
We use two groups on Cisco ACS . Group "A" must use two-factor authentication, and the group "B" don't.
how to create this rule?

[Marcin Latosiewicz · Accepted solution]

Perform rule base identity selection with dap-tunnel-group-name as selector. 

ASA will send tunnel group name in auth request. 

Example attached.

[Raketckii]

Hello Marcin.

I do not understand how this rule will apply to the base secureid? You associate  ASA with securid or ACS?

[Marcin Latosiewicz]

ASA associates with ACS, ACS with RSA over RADIUS. 

[Raketckii]

Everything works. Thank you!