Local authentication should not work if when radius is available

[iex2022]

We're configuring authentication and we have a requirement that Local authentication should not work if when radius is available.

Team - is that supported of Palo Alto Firewalls? Let me know if that is possible or any documents would help us.

Thank you

[S.Cantwell]

Hello there.

The configuration you are looking for is called Authentication Sequence.
You can configure the FW to first check Radius, and if the user fails Radius, to try to use Local.

But.. you cannot make Local NOT work, just because there is a Radius configuration.  It is a fail-through mechanism.

Hope that makes sense.

Thank you.

[F.Padua]

I saw this after 3 years, and this one is feasible. It's not uploaded to palo alto documentation. You may follow these steps for this to work.

1.) Create User on Local User Database.

2.) Create Authentication Profile and add your server profile (IP addresses)

3.) Create Auth Sequence, click the exit the sequence on failed authentication, under authentication profile, radius profile should be on top before the local.

4.) Create Administrator, Administrator type dynamic, super user and tick authentication profile to the created auth sequence, not the created auth profile.

5.) Test it out by logging in using local admin - your login will be denied.

6.) Test it out again while radius is temporarily down - your local login should be accepted.