A hospital must centralize logins with its existing RADIUS servers, requiring SD-WAN Manager GUI users to authenticate externally and 100 clinic WAN Edges to authenticate CLI admins externally with local fallback. Auditors demand separate handling for management versus device access. Which external AAA design for the Manager and for WAN Edges satisfies both needs?
Select an answer to reveal the explanation.
Short Explanation
Great separation of duties here — centralized templates let you govern hospital logins from one pane without mixing roles. Manager handles its own GUI, edges get their AAA pushed out.
Full Explanation
The correct design meets both auditor and operational constraints by keeping two distinct control points while reusing the hospital's existing investment: RADIUS integration on SD-WAN Manager centralizes GUI authentication for operators, while a centralized AAA feature template distributes RADIUS authentication with local fallback to all 100 WAN Edges for CLI access, preserving scale and survivability if servers become unreachable. The TACACS+ variant fails on protocol alignment because the scenario explicitly requires existing RADIUS servers to be reused, and while TACACS+ is indeed preferred in many enterprises for granular CLI authorization and accounting, introducing it here would require new infrastructure and violate the stated fact. The shared server-group variant fails on administrative separation because extending the identical Manager RADIUS group to devices collapses management-plane and device-plane authentication into one policy, which auditors explicitly forbid even though reuse looks efficient and is common in small labs. The dual-RADIUS variant fails on resilience logic because redundant primary and secondary servers protect against single-server failure but do not replace local fallback when WAN transport or both servers are unreachable, leaving clinics locked out during outages. For exams, remember that Manager GUI AAA and WAN Edge system AAA are configured in different places and must not be conflated, and that fallback order matters with external first then local. Practically, always push the template to a lab or pilot edge first, then verify with show commands and by simulating RADIUS unreachability to confirm local credentials permit CLI login and that Manager audit logs record external authentication events.