Which rule is responsible for the user authentication failure?

Rule 4 is evaluated after Rule 3, so it is never reached for this traffic flow because the rulebase stops processing at the first matching rule.

Rule 6 appears later in the rulebase and is never evaluated because Rule 3 already matched and acted on the traffic.

Rule 3 is the first rule in the rulebase that matches the user's traffic and applies a Drop or Reject action, causing authentication to fail before the user can be challenged. In Check Point policy, the rulebase is evaluated sequentially, so a deny action in Rule 3 terminates further rule processing. This prevents the user from reaching any rule that would initiate an authentication challenge.

Rule 5 is below Rule 3 in the rulebase and is also never reached for this traffic due to first-match processing.