A network engineer configures a router to authenticate administrative logins against a TACACS+ server reachable only through the management VRF via Loopback0. Local logins work as a fallback, but every attempt to authenticate to the TACACS+ server times out. Debugging shows the packets are being sourced from the outbound physical interface IP, which is not permitted on the ACL protecting the TACACS+ server. Which configuration will resolve the authentication failures?