Global Device/Setup Authentication Settings vs Device/Setup/Authentication Profile

[Metgatz]

Global Device/Setup Authentication Settings vs Device/Setup/Authentication Profile

Hello good afternoon, thank you very much for the usual collaboration.

I have the following doubt, at Global level in Device/Setup Authentication Settings there are parameters such as: Failed Attempts and Lockout Time and also if I create an Authentication profile appears the Account Lockout section, which are also Failed Attempts and Lockout Time settings.

Now that this is clear, if I create a local account called:
testadmin01

Then that account, I create it as in Device/Setup/Administrators, I associate it to an Authentication profile ( Local Database ), and in its Account Lockout settings I have configured Failed Attempts with value 3 and Lockout Time: 30 minutes.

But also at a global level, i.e. Device/Setup Authentication Settings I have Failed Attempts configured with value 5 and Lockout Time: 30 minutes.

Based on the above, which settings, which configurations are superimposed over the other ? the global or the custom authentication profile ? Which of the two is valid, which one has real practical validity?

Thank you

I remain attentive

Best regards

[kiwi · Accepted solution]

Hi @Metgatz ,

This is something that you can easily try out so I went ahead and tested it for you.

I use my local user configured with AuthProfile - The user was locked out after reaching the number of Failed Attempts which was configured on the AutProfile, totally ignoring my global lock out settings (which was configured with a lower number).

Tested on LAB environment running PAN-OS 10.1.x

Hope this helps,

-Kiwi.

[Metgatz]

Hello @kiwi Excellent, thanks a lot for your time! 

Best regards