When authenticating CLI users, the authentication-order statement controls how Junos checks the user credentials that are supplied.
This configuration statement is sometimes misunderstood and doesn’t always behave as you might expect.
Junos can authenticate users using (local) accounts and passwords on the device, RADIUS, TACACS+, or LDAPS.
The authentication-order statement tells the device in which order to try those methods. If none of the configured methods are available, the device will use the locally configured accounts and passwords.
Where the behavior becomes unexpected, is that Junos will try all the configured methods in order until it gets an “accept” or it runs out of methods to try. This means that even if the first method “rejects” the user credentials, Junos will still try the second and subsequent methods if needed.
If both RADIUS and TACACS are specified, even if RADIUS rejects the user, Junos will still see if the user can be authenticated via TACACS.
The method I recommend is to have the authentication-order set to one external type, whether that is RADIUS or TACACS, but to not specify the password method. This ensures that should the external authentication method reject the user, they will not be allowed to log in to the device. Should that method not be available for any reason, then we can still authenticate via local passwords.
In the following examples, I have created a user called ‘user5’, which has both a RADIUS account and a local account on the device. The passwords for these two accounts are different. To see how this is setup, look at this post on how to configure Junos CLI authentication using RADIUS.
For each configuration of authentication order, we show what happens when we try the local and the RADIUS passwords, as well as what traffic is being sent to the RADIUS server.
The ‘show cli authorization’ will also differ, depending on which method was used to successfully authenticate the user5 account.
No Authentication Order Set
In this scenario, no authentication order is set, so the device will try the local passwords only. As expected, logging in via RADIUS credentials fails and the local password works fine.
lab@vMX-1> show configuration system authentication-order | display set
lab@vMX-1>Local Password
Note the “Current User” field of the show cli authorization output.
:~$ ssh [email protected]
Password:
Last login: Thu Dec 29 05:38:19 2022 from 10.0.0.1
--- JUNOS 20.4R3-S2.6 Kernel 64-bit JNPR-11.0-20211117.c779bdc_buil
user5@vMX-1> show cli authorization | match class
Current user: 'user5 ' class 'super-user'
user5@vMX-1>RADIUS Password
:~$ ssh [email protected]
Password:
Password:
Password:
Received disconnect from 10.0.0.10 port 22:2: Too many password failures for user5
Connection to 10.0.0.10 closed by remote host.
Connection to 10.0.0.10 closed.Authentication Order Set To RADIUS Only
In this example, the authentication-order is set to RADIUS only. Therefore the user is accepted or denied solely based on the RADIUS response. If the RADIUS server was unavailable for any reason, the RADIUS requests would time out and the device would fall back to using the local passwords.
lab@vMX-1> show configuration system authentication-order | display set
set system authentication-order radius
lab@vMX-1>Local Password
:~$ ssh [email protected]
Password:
Password:
Password:
Received disconnect from 10.0.0.10 port 22:2: Too many password failures for user5
Connection to 10.0.0.10 closed by remote host.
Connection to 10.0.0.10 closed.Fxp0 Traffic
If we monitor traffic on interface fxp0 we can see Access-Request and Access-Reject messages being sent.
lab@vMX-1> monitor traffic interface fxp0 matching "host 10.0.0.5" no-resolve size 1500 detail
Address resolution is OFF.
Listening on fxp0, capture size 1500 bytes
05:49:13.784732 Out IP (tos 0x0, ttl 64, id 64015, offset 0, flags [none], proto: UDP (17), length: 96) 10.0.0.10.57443 > 10.0.0.5.1812: RADIUS, length: 68
Access Request (1), id: 0xa6, Authenticator: 5c13c5e37556ecaa4137d3300d4c7851
Username Attribute (1), length: 7, Value: user5
Password Attribute (2), length: 18, Value:
NAS ID Attribute (32), length: 7, Value: vMX-1
Calling Station Attribute (31), length: 10, Value: 10.0.0.1
NAS IP Address Attribute (4), length: 6, Value: 10.0.0.10
05:49:14.787100 In IP (tos 0x0, ttl 64, id 24623, offset 0, flags [none], proto: UDP (17), length: 48) 10.0.0.5.1812 > 10.0.0.10.57443: RADIUS, length: 20
Access Reject (3), id: 0xa6, Authenticator: 565199cf71312c1aaecdf086f20c1784
05:49:18.063915 Out IP (tos 0x0, ttl 64, id 64166, offset 0, flags [none], proto: UDP (17), length: 96) 10.0.0.10.61059 > 10.0.0.5.1812: RADIUS, length: 68
Access Request (1), id: 0xec, Authenticator: b4aa2590ef3078bf35bd18d68c242d67
Username Attribute (1), length: 7, Value: user5
Password Attribute (2), length: 18, Value:
NAS ID Attribute (32), length: 7, Value: vMX-1
Calling Station Attribute (31), length: 10, Value: 10.0.0.1
NAS IP Address Attribute (4), length: 6, Value: 10.0.0.10
05:49:19.073784 In IP (tos 0x0, ttl 64, id 25054, offset 0, flags [none], proto: UDP (17), length: 48) 10.0.0.5.1812 > 10.0.0.10.61059: RADIUS, length: 20
Access Reject (3), id: 0xec, Authenticator: e01ea0a2976bd6b214f32f23ecff4936
05:49:19.864166 In arp who-has 10.0.0.10 tell 10.0.0.5
05:49:19.864214 Out arp reply 10.0.0.10 is-at 50:00:00:01:00:00
05:49:27.583502 Out IP (tos 0x0, ttl 64, id 64492, offset 0, flags [none], proto: UDP (17), length: 96) 10.0.0.10.52302 > 10.0.0.5.1812: RADIUS, length: 68
Access Request (1), id: 0xdc, Authenticator: 6dda2938c4b8096e504fdff22e646c1e
Username Attribute (1), length: 7, Value: user5
Password Attribute (2), length: 18, Value:
NAS ID Attribute (32), length: 7, Value: vMX-1
Calling Station Attribute (31), length: 10, Value: 10.0.0.1
NAS IP Address Attribute (4), length: 6, Value: 10.0.0.10
05:49:28.585445 In IP (tos 0x0, ttl 64, id 26485, offset 0, flags [none], proto: UDP (17), length: 48) 10.0.0.5.1812 > 10.0.0.10.52302: RADIUS, length: 20
Access Reject (3), id: 0xdc, Authenticator: 99c5308ca206a64f5aa03e706280102e
^C
73 packets received by filter
0 packets dropped by kernel
lab@vMX-1>RADIUS Password
Note the “Current user” field in the show cli authorization output and how it differs from when the user is authenticated via the local account on the device.
:~$ ssh [email protected]
Password:
--- JUNOS 20.4R3-S2.6 Kernel 64-bit JNPR-11.0-20211117.c779bdc_buil
user5@vMX-1> show cli authorization | match class
Current user: 'rad-super' login: 'user5' class 'super-user'
user5@vMX-1>Fxp0 Traffic
We can also see the Access-Accept when monitoring fxp0.
lab@vMX-1> monitor traffic interface fxp0 matching "host 10.0.0.5" no-resolve size 1500 detail
Address resolution is OFF.
Listening on fxp0, capture size 1500 bytes
05:51:34.015303 Out IP (tos 0x0, ttl 64, id 3199, offset 0, flags [none], proto: UDP (17), length: 96) 10.0.0.10.51199 > 10.0.0.5.1812: RADIUS, length: 68
Access Request (1), id: 0x7c, Authenticator: 5813eb047cbb69be9c21595620c2d2bb
Username Attribute (1), length: 7, Value: user5
Password Attribute (2), length: 18, Value:
NAS ID Attribute (32), length: 7, Value: vMX-1
Calling Station Attribute (31), length: 10, Value: 10.0.0.1
NAS IP Address Attribute (4), length: 6, Value: 10.0.0.10
05:51:34.016682 In IP (tos 0x0, ttl 64, id 39433, offset 0, flags [none], proto: UDP (17), length: 65) 10.0.0.5.1812 > 10.0.0.10.51199: RADIUS, length: 37
Access Accept (2), id: 0x7c, Authenticator: 7fc85ae52146c7f5ce28c46b4f440ee7
Vendor Specific Attribute (26), length: 17, Value: Vendor: Juniper Networks (2636)
^C
157 packets received by filter
0 packets dropped by kernel
lab@vMX-1> Authentication Order Set To RADIUS And Password
With this configuration, the device will try to authenticate via RADIUS first, and if that is not successful it will then try the local passwords. This is shown when we try using the local password and a RADIUS request is sent.
This differs from the previous example, where the local passwords were only tried if the RADIUS server was unavailable.
lab@vMX-1> show configuration system authentication-order | display set
set system authentication-order radius
set system authentication-order password
lab@vMX-1> show configuration system authentication-order
authentication-order [ radius password ];
lab@vMX-1>Local Password
:~$ ssh [email protected]
Password:
Last login: Thu Dec 29 05:51:34 2022 from 10.0.0.1
--- JUNOS 20.4R3-S2.6 Kernel 64-bit JNPR-11.0-20211117.c779bdc_buil
user5@vMX-1> show cli authorization | match class
Current user: 'user5 ' class 'super-user'
user5@vMX-1> Fxp0 Traffic
Looking at the traffic on fxp0, we can see the router tried to use RADIUS first and received an Access-Reject.
lab@vMX-1> monitor traffic interface fxp0 matching "host 10.0.0.5" no-resolve size 1500 detail
Address resolution is OFF.
Listening on fxp0, capture size 1500 bytes
05:55:12.963894 Out IP (tos 0x0, ttl 64, id 10611, offset 0, flags [none], proto: UDP (17), length: 96) 10.0.0.10.58193 > 10.0.0.5.1812: RADIUS, length: 68
Access Request (1), id: 0x9e, Authenticator: ae28032c18c33494f2a59d8caa652e81
Username Attribute (1), length: 7, Value: user5
Password Attribute (2), length: 18, Value:
NAS ID Attribute (32), length: 7, Value: vMX-1
Calling Station Attribute (31), length: 10, Value: 10.0.0.1
NAS IP Address Attribute (4), length: 6, Value: 10.0.0.10
05:55:13.966191 In IP (tos 0x0, ttl 64, id 15153, offset 0, flags [none], proto: UDP (17), length: 48) 10.0.0.5.1812 > 10.0.0.10.58193: RADIUS, length: 20
Access Reject (3), id: 0x9e, Authenticator: e55ae60d6174dcedfbd09bc958cb64e4
05:55:19.024073 In arp who-has 10.0.0.10 tell 10.0.0.5
05:55:19.024107 Out arp reply 10.0.0.10 is-at 50:00:00:01:00:00
^C
179 packets received by filter
0 packets dropped by kernel
lab@vMX-1> RADIUS Password
:~$ ssh [email protected]
Password:
--- JUNOS 20.4R3-S2.6 Kernel 64-bit JNPR-11.0-20211117.c779bdc_buil
user5@vMX-1> show cli authorization | match class
Current user: 'rad-super' login: 'user5' class 'super-user'
user5@vMX-1> Fxp0 Traffic
lab@vMX-1> monitor traffic interface fxp0 matching "host 10.0.0.5" no-resolve size 1500 detail
Address resolution is OFF.
Listening on fxp0, capture size 1500 bytes
05:56:37.163534 Out IP (tos 0x0, ttl 64, id 13502, offset 0, flags [none], proto: UDP (17), length: 96) 10.0.0.10.54638 > 10.0.0.5.1812: RADIUS, length: 68
Access Request (1), id: 0x84, Authenticator: 3efe2991e5d1e7de87269014be8553bb
Username Attribute (1), length: 7, Value: user5
Password Attribute (2), length: 18, Value:
NAS ID Attribute (32), length: 7, Value: vMX-1
Calling Station Attribute (31), length: 10, Value: 10.0.0.1
NAS IP Address Attribute (4), length: 6, Value: 10.0.0.10
05:56:37.164899 In IP (tos 0x0, ttl 64, id 17731, offset 0, flags [none], proto: UDP (17), length: 65) 10.0.0.5.1812 > 10.0.0.10.54638: RADIUS, length: 37
Access Accept (2), id: 0x84, Authenticator: 4c53cda4dd1481e621156384cc2de298
Vendor Specific Attribute (26), length: 17, Value: Vendor: Juniper Networks (2636)
05:56:42.222563 In arp who-has 10.0.0.10 tell 10.0.0.5
05:56:42.222600 Out arp reply 10.0.0.10 is-at 50:00:00:01:00:00
^C
202 packets received by filter
0 packets dropped by kernel
lab@vMX-1>Authentication Order Set To Password And RADIUS
This time we have swapped the order of authentication, the local passwords will be tried first. This is shown by there being no RADIUS request when we try the local password to authenticate.
lab@vMX-1> show configuration system authentication-order | display set
set system authentication-order password
set system authentication-order radius
lab@vMX-1> show configuration system authentication-order
authentication-order [ password radius ];
lab@vMX-1>Local Password
:~$ ssh [email protected]
Password:
Last login: Thu Dec 29 05:56:37 2022 from 10.0.0.1
--- JUNOS 20.4R3-S2.6 Kernel 64-bit JNPR-11.0-20211117.c779bdc_buil
user5@vMX-1> show cli authorization | match class
Current user: 'user5 ' class 'super-user'
user5@vMX-1> Fxp0 Traffic
Note the lack of any RADIUS traffic as the router could successfully authenticate through the local account first.
lab@vMX-1> monitor traffic interface fxp0 matching "host 10.0.0.5" no-resolve size 1500 detail
Address resolution is OFF.
Listening on fxp0, capture size 1500 bytes
^C
149 packets received by filter
0 packets dropped by kernel
lab@vMX-1>RADIUS Password
:~$ ssh [email protected]
Password:
--- JUNOS 20.4R3-S2.6 Kernel 64-bit JNPR-11.0-20211117.c779bdc_buil
user5@vMX-1> show cli authorization | match class
Current user: 'rad-super' login: 'user5' class 'super-user'
user5@vMX-1> Fxp0 Traffic
fxp0 output
lab@vMX-1> monitor traffic interface fxp0 matching "host 10.0.0.5" no-resolve size 1500 detail
Address resolution is OFF.
Listening on fxp0, capture size 1500 bytes
06:00:31.027687 Out IP (tos 0x0, ttl 64, id 21668, offset 0, flags [none], proto: UDP (17), length: 96) 10.0.0.10.55740 > 10.0.0.5.1812: RADIUS, length: 68
Access Request (1), id: 0x8e, Authenticator: bb9dbe007ce979e48b55affae8fa641b
Username Attribute (1), length: 7, Value: user5
Password Attribute (2), length: 18, Value:
NAS ID Attribute (32), length: 7, Value: vMX-1
Calling Station Attribute (31), length: 10, Value: 10.0.0.1
NAS IP Address Attribute (4), length: 6, Value: 10.0.0.10
06:00:31.028747 In IP (tos 0x0, ttl 64, id 7151, offset 0, flags [none], proto: UDP (17), length: 65) 10.0.0.5.1812 > 10.0.0.10.55740: RADIUS, length: 37
Access Accept (2), id: 0x8e, Authenticator: 4f2878cf30b22b316023ce357c79cfbb
Vendor Specific Attribute (26), length: 17, Value: Vendor: Juniper Networks (2636)
06:00:36.201318 In arp who-has 10.0.0.10 tell 10.0.0.5
06:00:36.201351 Out arp reply 10.0.0.10 is-at 50:00:00:01:00:00
^C
178 packets received by filter
0 packets dropped by kernel
lab@vMX-1>
Muy buen articulo!
Hi,
Thanks for the feedback.