The Cisco TACACS+ on a Cisco Nexus Series Switch must authenticate any user attempting to access the device and fail over to the local account if the TACACS+ sever becomes unavailable. Which command…

Question

Options

• Aaaa authentication login default fallback error local
• Baaa authentication login console group local
• Caaa authentication login default local
• Daaa authentication login default group ISE local

• A
  2% (1)
• B
  2% (1)
• C
  5% (2)
• D
  90% (38)

Explanation

The requirement is to authenticate via TACACS+ first, then fall back to local accounts if the TACACS+ server is unreachable. The command 'aaa authentication login default group ISE local' accomplishes this: 'group ISE' references the named TACACS+ (or RADIUS) server group, making it the primary authentication method, and 'local' at the end specifies the fallback to local user accounts when the server group is unavailable. Answer A uses 'fallback error local' which is a valid variant but is not the standard Cisco NX-OS syntax for this behavior. Answer B applies only to the console port. Answer C uses only local authentication with no TACACS+ involvement. Answer D correctly implements both the primary TACACS+ server group and the local fallback in the proper NX-OS AAA syntax.

No community discussion yet for this question.