topic Re: Local authentication should not work if when radius is available in General Topics

Local authentication should not work if when radius is available

iex2022 — Mon, 15 Aug 2022 14:47:13 GMT

We're configuring authentication and we have a requirement that Local authentication should not work if when radius is available.

Team - is that supported of Palo Alto Firewalls? Let me know if that is possible or any documents would help us.

Thank you

Re: Local authentication should not work if when radius is available

S.Cantwell — Mon, 15 Aug 2022 15:27:45 GMT

Hello there.

The configuration you are looking for is called Authentication Sequence.
You can configure the FW to first check Radius, and if the user fails Radius, to try to use Local.

But.. you cannot make Local NOT work, just because there is a Radius configuration. It is a fail-through mechanism.

Hope that makes sense.

Thank you.

Re: Local authentication should not work if when radius is available

F.Padua — Thu, 13 Mar 2025 23:22:59 GMT

I saw this after 3 years, and this one is feasible. It's not uploaded to palo alto documentation. You may follow these steps for this to work.

1.) Create User on Local User Database.

2.) Create Authentication Profile and add your server profile (IP addresses)

3.) Create Auth Sequence, click the exit the sequence on failed authentication, under authentication profile, radius profile should be on top before the local.

4.) Create Administrator, Administrator type dynamic, super user and tick authentication profile to the created auth sequence, not the created auth profile.

5.) Test it out by logging in using local admin - your login will be denied.

6.) Test it out again while radius is temporarily down - your local login should be accepted.