A 200-switch hospital campus is moving admin login from local accounts to ISE TACACS+, while command authorization stays on ISE. Each switch already keeps one emergency privilege 15 username, and that account must still work over SSH when the ISE servers are unreachable. Which AAA command set provides the ISE-first login with local fallback?
Select an answer to reveal the explanation.
Short Explanation
Method lists run in the order you write them, so the server group gets first refusal and local is the spare key on the same ring. If ISE never answers, the switch falls back to its own usernames and your emergency account still opens SSH. That one keyword is the difference between an outage and a locked-out network team.
Full Explanation
On a switch running aaa new-model, an AAA method list is simply an ordered list of authentication sources, and group ISE-GROUP local tells the device to query the TACACS+ server group first, wait through the configured timeouts, then fall back to the local username database when no server answers. Because the vty lines use the default login list for SSH, that one trailing keyword is what keeps remote administration alive during an ISE outage. Configuring only the server group fails the fallback requirement because authentication then has no second method, so an unreachable server means every SSH attempt fails. Leading with local for login and using TACACS+ only for authorization fails because authentication never reaches ISE, so no ISE identity or session exists for the authorization phase to act on. A console-named list does not provide SSH fallback when the default network login list remains pointed at ISE alone; SSH uses the list configured for the vty lines. Exam caveat: the fallback works only when the emergency username exists locally with the right privilege level and the TACACS+ key matches the ISE service. Practical check: block the switch path to the ISE TACACS+ listener, SSH in with the emergency account, and confirm the TACACS+ live log shows no server response.