Authentication Failure Code for Cisco ACS

[soebeginner]

Hi, 

Understand that there's Failure Code 24408 for failed login attempt due to wrong password for AD account.

24408: User authentication against Active Directory failed since user has entered the wrong password

Is there any failure code I can look at for similar instance but for failed logins on local accounts instead? 

Thanks!

[balaji.bandi]

Look this information :

24408 User authentication against Active Directory failed since user has entered the wrong password

=========================================================================
Authentication failure gainst AD due to account is disabled
=============================================

[soebeginner]

Hi Balaji,
Thanks for the reply.
Yup, thats for account against Active Directory.
What if the account is a local account (i.e. not available in Active Directory) for instance, username=admin? Does it share the same code 24408? Or is there other failure code for local accounts?
Thanks!

[Sathiyanarayanan Ravindran]

If the account is configured on the ACS for login. That time you will get a error code as below.

Message Text	Failed-Attempt: Authentication failed
Failure Reason	22040 Wrong password or invalid shared secret

[soebeginner]

Hi Sathiya,

Thanks!
How about those accounts configured on the devices and that logins for the devices is send to cisco acs? e.g. failed login for admin account configured on firewall.

[Sathiyanarayanan Ravindran]

If TACACS is configured as a 1st priority and local as fall back. The error message would be 22056 Subject not found in the applicable identity store(s).

If Local as 1st priority and tacacs as second, The authentication will get drop at switch/Firewall. You won't get any logs on ACS.

[Kush]

Hello sir,

On ACS 5.8 patch 9 when we try to enable password hashing for local users on ACS authentication fails on secondary server with same error message 22040 wrong password on invalid shared secret.

Verified the password and shared secret. 

Authentications work fine on primary server with hashing enabled for local users.

Tried to change the sec to primary and encountered the same issue.

Could you please share your insights.