SRX

I want to implement CLI authentication via tacacs+ on Cisco ACS 5.3 server. I follow  KB17269, and i can successfull auth with Cisco ACS user, but also I can auth with local SRX users (in this time at ACS logs I can see that user "root" is not finded in identity stores, and access denied). But I want to do, that local users can auth only if tacacs+ server is unreachable (like it work in Cisco equipment). Is the any solution?

hi,

do you have 'system authentication-order tacplus password' ? Remove the 'password.

Please note the difference (password explicitly configured/not configured):

• http://www.juniper.net/techpubs/software/junos/junos74/swconfig74-system-basics/html/sys-mgmt-authentication15.html
• http://www.juniper.net/techpubs/software/junos/junos74/swconfig74-system-basics/html/sys-mgmt-authentication14.html

More reading at http://www.juniper.net/techpubs/en_US/junos/topics/concept/authentication-order-authentication-methods-overview.html. See note at the end (pre/post Junos 10.0 behavior)

jtb