AAA Authentication Order for FTD SSH CLI Access

[Serpens66]

I am thinking I need to settle with the fact the FTD-CLI seems to authenticate in this order: LOCAL then External

Anyone know if there is way to get a similar result to this command in a FTD?

aaa authentication ssh console ISE-RAD LOCAL

Or is it just not possible at the moment? 

[Marius Gunnerud]

I am assuming you have the same username for both Local and External authentication?  In either case as of now, the Local user database is checked first.

Internal and External Users

Firepower devices support two types of users:

• Internal user—The device checks a local database for user authentication. For more information about internal users, see Add an Internal User Account.

• External user—If the user is not present in the local database, the system queries an external LDAP or RADIUS authentication server. For more information about external users, see Configure External Authentication.

https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/user_accounts_for_management_access.html

[Serpens66]

Thanks for the response!  So, I have three AD users and then the default admin local user on the FTD, I want it to work where the local admin account simply won't work unless the external authentication fails, but your explanation just reinforces all the info I can find.

This doesn't work:

RADIUS Server up and working

External Users - Can log in

Internal (LOCAL) Users - Can't log in

RADIUS Server Down 

External Users - Cannot log in

Internal (LOCAL) Users - Can log in

[Marius Gunnerud · Accepted solution]

Your understanding is correct. Local users will always be able to login, radius users will only be able to log in when the server is available. 

[Serpens66]

Disappointing! I just wanted to be sure and have a topic for anyone else looking for a definitive answer. Thanks!