Description

When adding a new local user with super-user access on an SRX firewall, the user is unable to log in and receives an "Access Denied" error. This typically occurs when TACACS+ or other external authentication methods are configured without including the new user.

Symptoms

> Authentication fails with Access Denied error.
> TACACS+ configuration exists but does not include the new user or role.
> Local user authentication is not prioritized in the authentication order.

Solution

To allow local user authentication when external authentication methods are present, configure the authentication order to include password:

set system authentication-order password

This command ensures that local password authentication is prioritized or used as a fallback in the authentication flow. Without this configuration, Junos will attempt TACACS+ first and deny access if the user is not defined there.

By default, Junos OS verifies users based on their configured local passwords. However, when additional authentication methods (such as TACACS+) are configured, Junos attempts those first. If the external authentication fails and no fallback is defined, local users cannot log in.

 

Modification History

2025-12-28 : Article Created