Cico ISE + Fall back mechanism is not working

mothukuri — Mon, 09 Feb 2026 16:57:24 GMT

Hi All,

We have configured Cisco ISE as TACACS server. When Cisco ISE was not reachable from nexus7k/nexus 5k then we are not able to execute any commands on the nexus 7k /nexus 5k switches after logging into them via console.

Error is ,

Error: AAA authorization failed for command:show running-config, AAA_AUTHOR_STATUS_METHOD=17(0x11)

Below commands are configured for aaa .

aaa authentication login default group TACACS
aaa authentication login console local
aaa authorization commands default group TACACS local
aaa accounting default group TACACS

Below user is configured as a network-admin

username Test1 password Test123 role network-admin.

why user Test1 is not able to execute any commands whenever TACACS server is not reachable. We have tried to configure the switches via console access but no luck.

tacacs-server host x.x.x.x key 7 YYYY timeout 60
tacacs-server host z.z.z.z key 7 YYYY timeout 60
aaa group server tacacs+ TACACS
    server x.x.x.x
    server z.z.z.z
    use-vrf management
    source-interface mgmt0

Do I need to create another user with privilege level 15 to execute commands i mean to get into config mode to do configuration changes.

Why fallback mechanism is not working even though I have required aaa commands.

Any help on this will be highly appreciated.

Re: Cico ISE + Fall back mechanism is not working

balaji.bandi — Mon, 09 Feb 2026 17:45:53 GMT

what is the nexus OS code here :

Try adding below :

tacacs-server directed request

also try a timeout less :

tacacs-server timeout 5
tacacs-server deadtime 15

You can enable to see logs what is wrong :

aaa authentication login error-enable

topic Cico ISE + Fall back mechanism is not working in Network Access Control

Cico ISE + Fall back mechanism is not working

Re: Cico ISE + Fall back mechanism is not working