Disable Local Account when NAC is reachable

Claw4609 — Wed, 03 Aug 2022 16:21:12 GMT

Is there a way to disable the local account when an external authentication method is reachable? Only being able to log into the local account if it cant reach the external authentication server?

Re: Disable Local Account when NAC is reachable

kiwi — Thu, 04 Aug 2022 08:43:51 GMT

Hi @Claw4609 ,

I don't think you can disable an admin account directly on the administrator menu.

However there's a little trick you can do:

First create a local user via Device > Local User Database > Users

Then create a local authentication profile and add the user to it via Device > Authentication Profile

Next add the administrator account and use the local authentication profile via Device > Administrators

This way you can simply enable/disable the admin account by checking/unchecking the 'Enable' box on the Local User profile:

If you just need a fallback authentication method then you'll probably need to look at authentication sequence where you can put multiple authentication methods in sequence where the firewall tries the configured methods sequentially from top to bottom and will deny access if ALL of the methods fail.

Hope this helps,

-Kiwi.

topic Disable Local Account when NAC is reachable in General Topics

Disable Local Account when NAC is reachable

Re: Disable Local Account when NAC is reachable