This article shows an example where TACACS Authentication via JWeb on a SRX Branch Cluster fails for HTTPS traffic, while SSH Traffic works fine.

“We have a problem with SRX Chassis Cluster HTTP access. TACAS User authentication fails.”

Configuration:

system {
    backup-router 172.31.2.1 destination 0.0.0.0/0;
    time-zone Europe/Rome;
    authentication-order tacplus;
    root-authentication {
        encrypted-password "$ABC123"; ## SECRET-DATA
    }
    tacplus-server {
        192.168.159.244 {
            timeout 2;
            source-address 10.10.112.3;
        }
        192.168.159.229 {
            timeout 2;
            source-address 10.10.112.3;
        }
    }
    login {
        user test {
            uid 2003;
            class super-user;
        }
    }
    services {
        ssh {
            protocol-version v2;
        }
        web-management {
            https {
                system-generated-certificate;
            }
        }
    }
    syslog {
        user * {
            any emergency;
        }
        file messages {
            any notice;
            authorization any;
        }
        file interactive-commands {
            interactive-commands any;
        }
        file security-policy-logs {
            user info;
        }
    }
}

{primary:node0}
test@SRX650-node0> show route 

inet.0: 5 destinations, 5 routes (4 active, 0 holddown, 1 hidden)
+ = Active Route, - = Last Active, * = Both


20.20.20.1/32      *[Local/0] 19:49:20
                      Reject
172.31.2.0/24      *[Direct/0] 19:49:20
                    > via fxp0.0
172.31.2.18/32     *[Local/0] 19:49:20
                      Local via fxp0.0

Local credentials are ok for SSHv2 access:

Jul 21 23:18:08 SRX650-node0 sshd: tac_send_authen: Could not bind on socket: Can't assign requested address
Jul 21 23:18:08 SRX650-node0 sshd: auth server unresponsive
Jul 21 23:18:08 SRX650-node0 sshd: detected authentication server problem
Jul 21 23:18:08 SRX650-node0 sshd: [12]authentication information is unavailable
Jul 21 23:18:08 SRX650-node0 sshd: will attempt local password authentication
Jul 21 23:18:08 SRX650-node0 sshd: local password authentication of user 'test', succeeded
Jul 21 23:18:08 SRX650-node0 sshd[10797]: Accepted password for test from 172.31.2.1 port 1284 ssh2

However, authentication fails for for HTTPS:

Jul 21 23:18:18 SRX650-node0 checklogin[10808]: warning: can't get client address: Bad file descriptor
Jul 21 23:18:18 SRX650-node0 checklogin[10808]: tac_send_authen: Could not bind on socket: Can't assign requested address
Jul 21 23:18:18 SRX650-node0 checklogin[10808]: detected authentication server problem
Jul 21 23:18:18 SRX650-node0 checklogin[10808]: will attempt local password authentication
Jul 21 23:18:18 SRX650-node0 checklogin[10808]: WEB_AUTH_FAIL: Unable to authenticate httpd client (username test)

Changing the authentication order corrected the problem:

root@# set system authentication-order [ tacplus password ]


 

2025-06-26: Minor, non-technical update

2012-05-29: Article created