Authentication Fallback

[mrsold]

Hello,

So, we currently authenticate administrators to our PA's via Radius (TACACS).  Is there a way to configure the PA's that it will only use the local DB / Administrators if Radius isn't available? 

Thanks!

[Nico-Eisma]

I'm curious if anyone have come up with a solution to this as we have the same requirement.

I'm also thinking, if we create the same credentials on our radius as with the local db but the radius profile has less priviledge (almost no priviledges). Then if the auth sequence is radius1 & radius2 (for redundancy), then as long as both radius are available, then said local db credentials (superadmin) won't be used correct? Correct me if I'm understanding it wrong.

[MarkWalters]

FYI the docs may be wrong on this one, and the solution may work the way that @jseals  mentioned.  We authenticate VPN users against radius, and only if the radius servers are down should the local user database be used as a fallback.  In the Portal -> Authentication config, if the Radius auth is ordered first and the servers are responding, then the local user database is never checked.  Similarly, if the Local Database is ordered first, then auth will check the local database, and Radius is never checked (so putting anything after Local Database seems useless).  So we placed Radius first and Local Database second.

Not exactly the scenario that was mentioned above in the post, just a data point.