Local authentication should not work if when radius is available

[iex2022]

We're configuring authentication and we have a requirement that Local authentication should not work if when radius is available.

Team - is that supported of Palo Alto Firewalls? Let me know if that is possible or any documents would help us.

Thank you

[SCantwell_IM]

Hello there.

The configuration you are looking for is called Authentication Sequence.
You can configure the FW to first check Radius, and if the user fails Radius, to try to use Local.

But.. you cannot make Local NOT work, just because there is a Radius configuration.  It is a fail-through mechanism.

Hope that makes sense.

Thank you.