一 问题现象某客户华为USG6000系列防火墙登录web页面一直提示Authorization Required等待30分钟后可以正常登录更换edge、谷歌、火狐浏览器都无法登录但是一会有有时候登录成功等待一会又无法登录成功。二 分析过程调整防火墙策略将全通策略移到最前面问题依然存在通过console进入防火墙查看存在很多登录日志好像是防火墙账号锁定导致[USG6300E]Jun 30 2023 11:04:0008:00 USG6300E %%01SHELL/4/LOGINFAILED(s)[6]:Failed to login. (IpX.X.91.25, UserNameadmin, Times1, AccessTypeTELNET, VpnName)[USG6300E]Jun 30 2023 11:04:0608:00 USG6300E %%01SHELL/4/LOGINFAILED(s)[7]:Failed to login. (IpX.X.91.25, UserName**, Times2, AccessTypeTELNET, VpnName)[USG6300E]Jun 30 2023 11:04:1208:00 USG6300E %%01SHELL/4/LOGINFAILED(s)[9]:Failed to login. (IpX.X.91.25, UserNameadmin, Times1, AccessTypeTELNET, VpnName)[USG6300E]Jun 30 2023 11:04:2208:00 USG6300E %%01SHELL/4/LOGINFAILED(s)[10]:Failed to login. (IpX.X.91.25, UserName**, Times2, AccessTypeTELNET, VpnName)[USG6300E]三 解决方法有人输错密码多次锁定或者有人多次探测输入密码导致用户锁定30分钟默认用户锁定功能开启并且3次错误后锁定30分钟。解决方法aaa下关闭用户锁定功能undo lock-authentication enableaaaauthentication-scheme admin_adauthentication-scheme admin_ad_localauthentication-scheme admin_hwtacacsauthentication-scheme admin_hwtacacs_localauthentication-scheme admin_ldapauthentication-scheme admin_ldap_localauthentication-scheme admin_localauthentication-scheme admin_radiusauthentication-scheme admin_radius_localauthentication-scheme defaultauthorization-scheme defaultaccounting-scheme defaultservice-scheme l2tpSScheme_1654931567944ip-pool l2tpservice-scheme webServerScheme1578550985659domain defaultservice-scheme webServerScheme1578550985659service-type ssl-vpninternet-access mode passwordreference user current-domainmanager-user audit-adminpassword cipher $1a$1TI8%^o,$#u0VHvcF1$cRxMNoCX/IbBU(IW4xE)/Zl#26vY,$service-type web terminallevel 15manager-user api-adminpassword cipher $1a$B\9]m9(O$ti9lLRuW$$J)oW9uiI(A:dIxn}-B3Q6-S*pZL$service-type apilevel 15manager-user adminpassword cipher $1a$$xP4N!R$#P1~%PY45K\dHSf/eUH$9}_Y6)[Nr10zDg,$service-type web terminal telnet sshlevel 15undo lock-authentication enable //aaa下配置如下命令解决role system-adminrole device-adminrole device-admin(monitor)role audit-adminbind manager-user audit-admin role audit-adminbind manager-user admin role system-admin