topic Re: Failed login alerts because of TACACS+ authentication failure in General Topics

Failed login alerts because of TACACS+ authentication failure

Firewall_Head — Thu, 13 Mar 2025 12:20:25 GMT

Hi Checkmates,

I have a firewall with TACACS+ enabled and it's working fine.

I also have some local users configured for administration, but whenever I login using the local user ID, it creates a "failed authentication" log.

Why is my local user even getting authenticated with the TACACS+ server.

Can somebody help me on this ? This is creating a headache for the SOC team.

Thanks in advance !

========

WR,

Re: Failed login alerts because of TACACS+ authentication failure

the_rock — Thu, 13 Mar 2025 16:01:48 GMT

Hey bro,

Do you have a screenshot of it by any chance?

Andy

Re: Failed login alerts because of TACACS+ authentication failure

Firewall_Head — Thu, 13 Mar 2025 17:52:35 GMT

Hi @the_rock ,

Logs coming up, give me sometime.

====

WR,

Re: Failed login alerts because of TACACS+ authentication failure

the_rock — Thu, 13 Mar 2025 17:53:34 GMT

If it does not help, we can do quick remote tomorrow.

Andy

Re: Failed login alerts because of TACACS+ authentication failure

the_rock — Mon, 17 Mar 2025 16:33:04 GMT

Hey bro,

Just thought of something. IF you want to block local users from connecting, you can run blockSFAInternalUsers command from fw expert mode to see what it shows, just add -s flag and it would show you how to block it if you want.

Andy

[Expert@R82:0]# blockSFAInternalUsers

Internal User, Single Factor Auth. Blocking Utility

Usage: blockSFAInternalUsers [flags]

-s show current status
-a allow internal users with password single factor to authenticate
-b block internal users with password single factor from authenticating

[Expert@R82:0]# blockSFAInternalUsers -s

blockSFAInternalUsers: Allowed

[Expert@R82:0]#