A government agency can log in to Nexus only while the TACACS+ servers answer. When those servers are unreachable, valid local accounts are rejected because the login method list names only the TACACS+ group. What should that list include next?
Select an answer to reveal the explanation.
Short Explanation
The outside guard shack is empty, and you never gave anyone a key to the door in the lobby. You add local authentication after the TACACS+ group so a valid on-box account can still log in when the servers do not answer. A role does not help if the login method never gets far enough to assign one.
Full Explanation
NX-OS walks the login method list in order. A list that names only the TACACS+ group can succeed while those servers answer and can reject everyone when they do not, including accounts that exist in the local user database. Adding local as the next method tells the switch to use that database after TACACS+ is unreachable, which is the fallback this agency is missing. MACsec encrypts frames on a link and authenticates the link peers. It does not log an operator into the CLI when a AAA server times out. An OSPF key chain rotates keys for routing-protocol authentication. It is not a user database and it does not accept a console or SSH login. An RBAC role decides which commands a session may run after authentication succeeds. A role with no login methods does not answer the password prompt, so it cannot replace a missing local method. Caveat: local fallback helps only for accounts that were actually created on the switch, and the TACACS+ servers still need to be marked unreachable before the switch moves on. Operational check: stop the test path to the TACACS+ servers, log in with a local account, and confirm a network-admin role is not required just to prove the fallback works.