A campus team administers 30 routers and switches through ISE with TACACS+. Policy requires every routine administrator login to be checked by ISE first, and a break-glass account must still work if the ISE servers are unreachable during an outage. Which AAA configuration on the router gives centralized authentication with a working local fallback?
Select an answer to reveal the explanation.
Short Explanation
Your method list runs in order and moves to the next source only when the first returns an error or is unavailable—not when it rejects the login. So ISE must come first and local second. That's the main door with a spare key hidden in the drawer. Keeping local last saves you during an outage.
Full Explanation
Router AAA method lists are ordered lists of authentication sources tried in sequence. The router moves to the next source only if the previous method returns an error, such as when its servers are unreachable; an authentication rejection does not trigger fallback. Placing the ISE TACACS+ group first and local second therefore gives centralized checking with a working backup. When ISE is unreachable, the router can fall through to its local database, where the break-glass account is stored. Restricting the list to the TACACS+ group alone removes that fallback, so an outage can lock administrators out. Putting local before the group lets local users authenticate without ISE, contrary to the requirement that routine logins be checked by ISE first. The enable secret does not create a login fallback: it guards entry into privileged EXEC mode rather than providing an alternate login authentication source. To verify the fallback, test the configured login method list while the router cannot reach the ISE servers.