A campus team is moving 40 access switches from enable passwords to ISE for TACACS+ device administration, with shell profiles granting privilege 15 to the network operations group. Operations requires that administrators can still log in over SSH when an ISE node is unreachable during a maintenance window. Which switch AAA configuration delivers ISE device administration with local fallback?

ISE device administration requires TACACS+ login and exec authorization, with both method lists applied to the VTY lines used for SSH. This lets ISE provide the network operations group’s privilege-15 shell profile during normal operation, while the local method allows a switch to authenticate a configured local user if ISE is unreachable or returns an error. Using ISE-first login with local fallback but assigning privilege locally omits ISE exec authorization, so it does not meet the shell-profile requirement. Applying the correct login and exec-authorization services only to console lines leaves SSH administration without those lists. Using an enable secret as the outage fallback also fails: the secret is used to enter privileged mode after login, not to authenticate an SSH session when ISE is unavailable. Exam caveat: AAA method lists generally try the next method when the preceding server is unavailable or returns an error, not when it explicitly rejects a user, so local fallback does not bypass an ISE denial. Practical check: in a controlled test, confirm a valid ISE login receives privilege 15, then make ISE unreachable and verify that a configured local account can still SSH in with the intended privilege.