An authentication methods list defines the order in which authentication should be attempted, and provides backup methods in the event that a method fails to authenticate a user. The local method must be included in the list, preferably first to reduce the risk of local account access issues.
If a method denies a user or is not reachable, the next method in the list is tried. If there are multiple servers within a method (assuming the method is contacting authentication servers), and a server timeout is encountered, then the next server in the list is tried.
If the current server being contacted issues an authentication reject, no other servers for that method are tried and the next method in the list is attempted. If no method validates a user, the user is denied access to the appliance.
You can configure the system to track authentication attempts, limit authentication based on previous failures, and so on.