External Users Authentication & on box authentication

Hi, not my area of expertise, but it looks pretty binary (either local or remote). I created a local user and authenticated the LTM UI just fine. Then flipped authentication to remote and was unable to authenticate any longer. This TACACS+ server hasn't been working properly for some time. Two thoughts: The TACACS authentication screen lets you add multiple TACACS servers for resiliency. If there is any authentication issue blocking user access, the admin and root accounts remain local for you to access and perform any necessary config tweeks.

As said above, the admin and root account remain on the box even with TACACS authentication.

Test this whilst logged in as root or admin so that you can be sure to roll back any changes you make. If it's not working, check the config on the TACACS and LTM twice and then get someone else to check it. After that, do a tcpdump to see whether network connectivity is OK.

You can also use remote roles where you assign a role on the LTM and assign users to the role via TACACS using AVPs.

We use Cisco ACS as our authentication server and have our F5's configured for radius authentication and a remote role configured on the F5's that is returned by the radius server (this way we don't have to configure users on the F5's).

Any accounts other than root or admin will attempt to use the remote authentication method that is configured, even if it's down. So in the event that your authentication servers fail only the root or admin accounts will be able to log into the F5.

Thanks guys your input really helped.....