Question

A network administrator configures ISE as a TACACS+ server for device administration on a set of IOS switches. Command authorization is enabled with 'aaa authorization commands 15 default group ISE-TACACS'. During a maintenance window, all ISE PSNs become unreachable. When the administrator logs in via the console (already authenticated locally), every privilege-level 15 command is rejected. What single configuration change on the switch will allow authorized local commands to execute when the TACACS+ servers are unreachable?

Accepted Answer

Append the 'local' keyword to the command authorization method list: 'aaa authorization commands 15 default group ISE-TACACS local'

Answer

Add 'aaa authorization console' so console sessions bypass TACACS+ command authorization entirely

Answer

Configure 'aaa authentication login default group ISE-TACACS local' to add a local fallback for authentication

Answer

Reduce the TACACS+ server timeout with 'tacacs-server timeout 1' so the switch fails over faster