PCNSA · Question #340
The Administrator profile "PCNSA Admin" is configured with an Authentication profile "Authentication Sequence PCNSA". The Authentication Sequence PCNSA has a profile list with four Authentication…
The correct answer is C. Auth OK because of the Auth Profile Local. In an authentication sequence, if initial methods like LDAP and RADIUS fail, the firewall proceeds to the next profile; thus, the 'PCNSA Admin' can still authenticate via the 'Auth Profile Local' if it's functional and listed after the failed attempts.
Question
The Administrator profile "PCNSA Admin" is configured with an Authentication profile "Authentication Sequence PCNSA". The Authentication Sequence PCNSA has a profile list with four Authentication profiles:
Auth Profile LDAP Auth Profile Radius Auth Profile Local Auth Profile TACACS After a network outage, the LDAP server is no longer reachable. The RADIUS server is still reachable but has lost the "PCNSA Admin" username and password. Which option describes the "PCNSA Admin" login capabilities after the outage?
Options
- AAuth OK because of the Auth Profile TACACS
- BAuth KO because RADIUS server lost user and password for PCNSA Admin
- CAuth OK because of the Auth Profile Local
- DAuth KO because LDAP server is not reachable
How the community answered
(18 responses)- A6% (1)
- B6% (1)
- C78% (14)
- D11% (2)
Why each option
In an authentication sequence, if initial methods like LDAP and RADIUS fail, the firewall proceeds to the next profile; thus, the 'PCNSA Admin' can still authenticate via the 'Auth Profile Local' if it's functional and listed after the failed attempts.
The TACACS+ profile is the last in the sequence; if the 'Auth Profile Local' is functional and precedes TACACS+, authentication will succeed there first without reaching TACACS+.
While the RADIUS server failing due to lost credentials causes that specific attempt to fail, the authentication sequence is designed to continue trying subsequent profiles, preventing a complete authentication failure at this stage.
Authentication sequences are designed for failover; since LDAP is unreachable and RADIUS fails due to incorrect credentials, the firewall will attempt the next method in the sequence, which is 'Auth Profile Local,' allowing successful authentication if the account exists locally.
The LDAP server being unreachable is only one failure in the sequence; the authentication process will continue to the next available profile in the list, such as RADIUS, Local, or TACACS+, until a successful method is found or all fail.
Concept tested: Authentication sequence failover
Source: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/authentication/configure-an-authentication-profile/configure-an-authentication-sequence.html
Topics
Community Discussion
No community discussion yet for this question.