A university must integrate SD-WAN Manager logins and WAN Edge admin logins with campus RADIUS and TACACS+ servers, preserving local fallback if external servers fail. Auditors require command authorization for network operators. Which external AAA design should the engineer configure to cover Manager and WAN Edge access?
Select an answer to reveal the explanation.
Short Explanation
You want one identity story across controllers and edges without losing access. Separate AAA configs with a safety net keep auditors happy, and fallback-local saves you during outages.
Full Explanation
External AAA separates authentication, authorization and accounting, where SD-WAN Manager supports RADIUS and TACACS+ for GUI and API logins with roles and command authorization, and WAN Edge routers support AAA via feature templates for SSH and NETCONF with server groups and local fallback if unreachable. Configuring both sides satisfies the requirement because Manager and Edge enforce logins independently and auditors can trace per-user authorization. Configuring only on Manager fails the concept because there is no automatic credential push that makes Edges use Manager AAA for their own shell access. Using only local users satisfies fallback but misses centralized policy and authorization because password rotation and command accounting do not scale. Using only certificates satisfies device authentication for control connections but misses interactive user AAA because certificates authenticate devices to Controllers, not operator command authorization. For the exam, remember TACACS+ separates authorization for per-command control while RADIUS combines it, and in practice test server reachability, fallback login and accounting logs on both Manager and a sample Edge.