08-10-2021 09:41 PM
Hi @PankajDhobe ,
Can you give a bit more information? It would be useful to see your config (you can hide the TACACS server details).
- Have you configured authentication profile that is using the TACACS server?
- Have you configured that auth profile to be used for admin access - Device -> Management -> Authentication Settings
- Or you have configured the users locally and each user is configured with tacacs auth profile?
- This is a good document for configuring TACACS - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PMYmCAO&lang=en_US%E2%80%A...
- What VSA have you configured on your server?
- Do you have duplication between local and tacacs usernames?
Long, long time ago I have experience something similar when authentication protocol (under Server profile) was wrong. My experience was with RADIUS and we initially configured something else, while the radius server was expecting PAP. Because of that when user put his credentials FW was prompting him with challenge-response - even that the radius server was not configured for such.
Password complexity policy should affect only local users so I am assuming either tacacs authentication is not working properly, or FW is matching your local user first.
