External Users Authentication & on box authentication

As said above, the admin and root account remain on the box even with TACACS authentication.

Test this whilst logged in as root or admin so that you can be sure to roll back any changes you make. If it's not working, check the config on the TACACS and LTM twice and then get someone else to check it. After that, do a tcpdump to see whether network connectivity is OK.

You can also use remote roles where you assign a role on the LTM and assign users to the role via TACACS using AVPs.