PCNSA · Question #389
The administrator profile "SYS01 Admin" is configured with authentication profile "Authentication Sequence SYS01," and the authentication sequence SYS01 has a profile list with four authentication…
The correct answer is C. Auth OK because of the Auth Profile Local. The firewall processes authentication profiles in the defined sequence until a successful authentication occurs or all profiles in the list fail. Despite external server failures, the local authentication profile serves as a fallback.
Question
The administrator profile "SYS01 Admin" is configured with authentication profile "Authentication Sequence SYS01," and the authentication sequence SYS01 has a profile list with four authentication profiles:
- Auth Profile LDAP
- Auth Profile Radius
- Auth Profile Local
- Auth Profile TACACS
After a network outage, the LDAP server is no longer reachable. The RADIUS server is still reachable but has lost the "SYS01 Admin" username and password. What is the "SYS01 Admin" login capability after the outage?
Options
- AAuth KO because RADIUS server lost user and password for SYS01 Admin
- BAuth OK because of the Auth Profile TACACS
- CAuth OK because of the Auth Profile Local
- DAuth KO because LDAP server is not reachable
How the community answered
(44 responses)- A5% (2)
- B11% (5)
- C80% (35)
- D5% (2)
Why each option
The firewall processes authentication profiles in the defined sequence until a successful authentication occurs or all profiles in the list fail. Despite external server failures, the local authentication profile serves as a fallback.
While the RADIUS server has lost the user and password, the authentication sequence continues to the next profile ('Auth Profile Local'), preventing a definitive authentication failure at this stage.
The TACACS profile is further down the authentication sequence; if local authentication succeeds, the TACACS profile will not be attempted.
Authentication sequences process profiles in order; since LDAP is down and RADIUS fails due to incorrect credentials, the firewall proceeds to the 'Auth Profile Local'. If the 'SYS01 Admin' account is defined locally on the firewall, authentication will succeed at this step.
Although the LDAP server is not reachable, the authentication sequence is configured to try other profiles, so the failure of LDAP alone does not immediately result in an authentication failure.
Concept tested: Authentication sequence processing and fallback
Source: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/authentication/authentication-sequences
Topics
Community Discussion
No community discussion yet for this question.