SBC audit log and authentication

Hi,

We are looking for advices to put a 2FA authentication and put tracking on our SBCs.

First question, can we have 2FA authentication via RSA token instead of SSH key ?

Otherwise TACCACS + could meet our needs according to the documentation, it allows to manage authentication, authorization and the tracking of actions. but cannot find how it works practically.

TACCAS + records itself the actions as in the cli.audit.log file  ?

otherwise I will take any other recommendation regarding authentication and externalization of the cli.audit.log file. 

Many thanks