We have the same request. Our switches are in Local mode.
We are required by some clients to have 2FA on these switches and we run with the 1930 & 1960's
There are NO IP restrictions either which would allow us to secure them. Since we can limit only hosts IP's with 2FA to access https.
------------------------------
Vaughn
------------------------------