Failed login alerts because of TACACS+ authentication failure

[Firewall_Head]

Hi Checkmates,

I have a firewall with TACACS+ enabled and it's working fine. 

I also have some local users configured for administration, but whenever I login using the local user ID, it creates a "failed authentication" log.

Why is my local user even getting authenticated with the TACACS+ server.

Can somebody help me on this ? This is creating a headache for the SOC team.

Thanks in advance !

========

WR,

FH

[the_rock]

Hey bro,

Do you have a screenshot of it by any chance?

Andy

[Firewall_Head]

Hi @the_rock ,

Logs coming up, give me sometime.

====

WR,

FH

[the_rock]

If it does not help, we can do quick remote tomorrow.

Andy

[the_rock]

Hey bro,

Just thought of something. IF you want to block local users from connecting, you can run blockSFAInternalUsers command from fw expert mode to see what it shows, just add -s flag and it would show you how to block it if you want.

Andy

[Expert@R82:0]# blockSFAInternalUsers

Internal User, Single Factor Auth. Blocking Utility

Usage: blockSFAInternalUsers [flags]

-s show current status
-a allow internal users with password single factor to authenticate
-b block internal users with password single factor from authenticating

[Expert@R82:0]# blockSFAInternalUsers -s

blockSFAInternalUsers: Allowed

[Expert@R82:0]#