4

I'm pretty sure you can do this in the Cisco world, but haven't found a way to do this on a Juniper device. Is there a way to restrict local accounts from being accessed if the router has access to TACACS?

More specifically, is there a way to configure the router so it behaves in the following way:

  1. If the router can authenticate a user via TACACS, the username/password stored on the device is not accessible.
  2. If TACACS is not available, the local account is then accesible.

Is this possible?

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 11 '17 at 14:48
5

This is actually default behavior.

The only way a local login will even be attempted is if all other authentication types fail (TACACS and/or RADIUS).

So in your case, the only time your local password database will be consulted is if the TACACS server(s) fail to respond to any requests. If you attempt to login, but TACACS rejects your password, the local database is NOT consulted.

From: Juniper Authentication Order Methods

The password authentication method is not explicitly configured as one of the authentication methods in the authentication-order authentication-methods statement. In this case, the password authentication method is tried only if all configured authentication methods fail to respond. It is not consulted if any configured authentication method returns a reject response because of an incorrect username or password.

If you're seeing different behavior, check for the following configuration statement (be aware it has sub-options, for more info see Configuring Authentication Order):

R1> show configuration system authentication-order

If this is configured in the right way, the authentication database WILL be consulted if the TACACS server fails to respond OR rejects a password attempt.

The password authentication method (password) is explicitly configured as one of the authentication methods in the [authentication-order authentication-methods] statement. In this case, the password authentication method is tried if no previous authentication accepts the logon credentials. This is true whether the previous authentication method fails to respond or returns a reject response because of an incorrect username or password.

So to be extra clear, you do not want authentication-order configured at all to achieve the default behavior.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.