ISE & Duo Enhanced Integration for MFA

Cisco ISE Technical Marketing Engineer, Thomas Howard, explains the latest native API-based integration of Duo with ISE 3.3+Patch1 for VPN and TACACS+ user authentication.

Topics:
00:00 Intro and Agenda
00:32 ISE Releases and Patches
01:38 ISE Patches Contain Features
02:30 Zero Trust
03:17 ISE for Zero Trust in the Workplace
04:20 Network Access Authentication Spectrum
07:50 The Need for MFA with VPN
08:44 ISE & Duo Integration with Duo Authentication Proxy
10:00 ISE 3.3.1 with Duo API Integration
11:20 MFA Requires a Finger and Phone
12:09 ISE and Duo are Complementary for Zero-Trust On-Premises and Cloud
14:10 Demo: Setup Duo Admin API and Auth API for ISE 3.3.1
Note: Requires 🔒Duo Owner/Administrator Account Permission!
15:43 Demo: Configure Duo MFA Integration in ISE with Active Directory
19:22 Demo: VPN Policy Configuration Update and Test with Duo MFA
23:12 Enhanced ISE + Duo Integration for MFA feature roadmap
25:39 The Need for MFA with Device Administration (TACACS+)
28:07 TACACS+ Protocol
30:10 ISE Supports TACACS+ and RADIUS
30:58 Demo: Device Administration/TACACS+ Configuration with MFA
36:05 Configure ISE 3.3 Native Multi Factor Auth with Duo
36:37 Partners: Cisco dCloud ISE 3.3 Enterprise & Security Demo
38:04 ISE 2.x to 3.x License Migration Offer

Resources

[mikethompson]

Subscribed! I'll check out your videos. I've recently been given a project to implement NAC with cert auth using ISE as the authentication server and I don't know anything about ISE. I hope I don't blow up my whole environment. Trying to learn everything I can so I am successful.

Thank you for investing your time into this video to share with us amateurs who are just trying not to take everything down.

[alessiogaletta]

Is it possible to cache the MFA for a admin that has to login to multiple network devices trough SSH for like 1 hours, so the employer do not have to accept the mfa everytime?