AAA is configured with 'aaa authentication login default group tacacs+ local'. During a TACACS+ server outage, user logins successfully authenticate locally. What is required on the router for this fallback to work?

The command aaa authentication login default group tacacs+ local specifies an authentication method list. The router attempts authentication using the first method in the list (group tacacs+). If that method fails (e.g., TACACS+ server is unreachable), it proceeds to the next method in the list, which is local. For local authentication to succeed, a corresponding username and password must be configured in the router's local database. Without a local user entry, the local authentication method would also fail, and the login attempt would be denied. The TACACS+ server does not need to be reachable at all times, as the local keyword provides a fallback. RADIUS is not required, as local is already specified. The order local group tacacs+ would prioritize local authentication, which is not the behavior described.