Superuser (read-only) Not authorized to access

[MichaelBorg]

Hi everyone,

I am trying to get TACACS working between our PA and Aruba Clearpass authentication server. I have successfully done this for full admin as well as a custom role on the firewall. I am however running into issues with a service account logging in with read only access.

When I try to login to the local firewall with this service account I get the message "Not authorized to access" (please see screenshot PACLP1.PNG). This is further confirmed by the firewall systems logs (please see screenshot PACLP2.PNG). The role name that I specified in Clearpass is correct however, I copied and pasted the name from the local firewall account role into Clearpass so this should be fine (please see screenshot PACLP3.PNG).

This worked fine with the local firewall account but something is wrong with the authorization of this Clearpass integration. Not sure if this matters but when the service account was local on the firewall and working it was using Radius but with this Clearpass integration I'm using TACACS. I don't think this is an issue as 2 different types of login (normal firewall superuser as well as a custom role) work fine. Can anyone please advise. Thank you in advance.

[MichaelBorg]

Update - I created a custom role on the firewall and made it as read-only as I can and that works fine. Am I not able to successfully reference the dynamic firewall Superuser (read-only) role? This works for the dynamic Superuser role so I thought it would work.

[BPry · Accepted solution]

@MichaelBorg,

Try using superreader as the value, that's what the firewall actually uses on the backend.

[MichaelBorg]

Hi,

Sorry for the delay. Many thanks for that advise, I'll try that tomorrow and let you know.

[MichaelBorg]

Thank you Bpry, adding superreader instead worked 🙂