JN0-102 · Question #190
The authentication order configuration on your M120 includes the settings tacplus and radius (in that order), but does not include the password parameter. You attempt to log in to the device, but…
The correct answer is C. The M120 automatically tries authenticating locally on the device after the authentication servers' timeout. If external authentication servers are unreachable and the password (local) option is not explicitly included in the authentication order, Junos OS still attempts local authentication as a fallback after external methods time out.
Question
The authentication order configuration on your M120 includes the settings tacplus and radius (in that order), but does not include the password parameter. You attempt to log in to the device, but the network containing the authentication servers is currently down. Which statement is true about your login attempt?
Options
- AThe login attempt is rejected.
- BThe login attempt is automatically accepted after the authentication servers' timeout value is reached,
- CThe M120 automatically tries authenticating locally on the device after the authentication servers' timeout
- DThe M120 automatically tries authenticating locally on the device before using external authentication.
How the community answered
(14 responses)- A7% (1)
- C86% (12)
- D7% (1)
Why each option
If external authentication servers are unreachable and the `password` (local) option is not explicitly included in the authentication order, Junos OS still attempts local authentication as a fallback after external methods time out.
The login attempt is not immediately rejected because Junos OS includes a default fallback to the local user database.
The login attempt is not automatically accepted; authentication must still succeed against a valid local user account.
By default, Junos OS will try authentication methods in the configured order; if external servers (TACACS+ and RADIUS in this case) are unreachable, the device will wait for their timeout and then automatically fall back to the local user database, even if `password` is not explicitly listed in the authentication order.
Junos OS attempts authentication methods in the configured order (TACACS+ then RADIUS); local authentication is attempted after external methods fail or time out, not before.
Concept tested: Junos OS authentication order and local fallback
Source: https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/junos-os-user-authentication-methods.html#junos-os-user-authentication-methods__section-authentication-order
Topics
Community Discussion
No community discussion yet for this question.