I'm pretty sure you can do this in the Cisco world, but haven't found a way to do this on a Juniper device. Is there a way to restrict local accounts from being accessed if the router has access to TACACS?
More specifically, is there a way to configure the router so it behaves in the following way:
Is this possible?
This is actually default behavior.
The only way a local login will even be attempted is if all other authentication types fail (TACACS and/or RADIUS).
So in your case, the only time your local password database will be consulted is if the TACACS server(s) fail to respond to any requests. If you attempt to login, but TACACS rejects your password, the local database is NOT consulted.
From: Juniper Authentication Order Methods
The password authentication method is not explicitly configured as one of the authentication methods in the authentication-order authentication-methods statement. In this case, the password authentication method is tried only if all configured authentication methods fail to respond. It is not consulted if any configured authentication method returns a reject response because of an incorrect username or password.
If you're seeing different behavior, check for the following configuration statement (be aware it has sub-options, for more info see Configuring Authentication Order):
R1> show configuration system authentication-order
If this is configured in the right way, the authentication database WILL be consulted if the TACACS server fails to respond OR rejects a password attempt.
The password authentication method (password) is explicitly configured as one of the authentication methods in the [authentication-order authentication-methods] statement. In this case, the password authentication method is tried if no previous authentication accepts the logon credentials. This is true whether the previous authentication method fails to respond or returns a reject response because of an incorrect username or password.
So to be extra clear, you do not want authentication-order configured at all to achieve the default behavior.
have the following line configured:
set system authentication-order tacplus
but NOT the following line:
set system authentication-order password
In the above configuration, you achieve tacacs only authentication.... That is.. if the tacacs server rejects, the local username/password is NOT consulted.
If the tacacs servers, however, is not reachable/available, then implicitly, the local username/password is consulted.
