Last Modified: Oct 22, 2026
Affected Product(s):
BIG-IP TMOS
Known Affected Versions:
17.5.1.9, 17.5.1.10
Opened: Oct 16, 2026 Severity: 3-Major
REST API authentication via iControl REST ("/mgmt/shared/authn/login") fails with HTTP 401 "CreateTokenException" when the primary TACACS+ server is actively rejecting connections (TCP RST). SSH and GUI authentication continue to work correctly by failing over to the secondary TACACS+ server. The following error messages appear in "/var/log/secure": err pam-authenticator[<PID>]: pam_tacplus: connection failed srv 0: Connection refused notice pam-authenticator[<PID>]: pam_tacplus: pam_tacplus: user <username> not authenticated The REST API response contains: json { "code": 401, "message": "Authentication failed.", "kind": ":resterrorresponse" }
REST API clients (automation scripts, monitoring tools, orchestration platforms) receive HTTP 401 authentication failures and cannot authenticate to BIG-IP when the primary TACACS+ server is unavailable due to active connection rejection. This blocks all iControl REST API operations including token creation, configuration management, and monitoring queries.
- BIG-IP configured with two or more TACACS+ authentication servers. - The primary TACACS+ server actively rejects TCP connections on port 49 (sends TCP RST) - due to server failure, firewall policy, service crash, or misconfiguration. - Authentication is attempted via iControl REST API (token-based or basic authentication).
None
None