tacacs-authentication-only

Hello there,

While configuring TACACS on our SBC, I've noticed that users can bypass the TACACS authentication and latch to the SBC as Admin.

My configuration is meant to prohibit such access as I've set the parameter tacacs-authentication-only =enabled

how can you explain this behavior ? is it a bug?

Is that due to the parameter login-as-admin = enabled?

Below is my configuration

authentication
       source-port                            abcd
       type                                   tacacs
       protocol                               pap
       tacacs-authentication-only             enabled
       tacacs-authorization                   enabled
       tacacs-authorization-arg-mode          disabled
       tacacs-accounting                      enabled
       server-assigned-privilege              disabled
       allow-local-authorization              disabled
       login-as-admin                         enabled

WEIRED !!!

tacacs-authentication-only

When enabled, restricts remote login to TACACS+ when available.

login-as-admin

Enable this parameter if you want users to be logged automatically in Superuser