On a Catalyst 3560 where TACACS+ SSH authentication falls back to local accounts, which command fixes the TACACS source-interface?

The command ip tacacs source-interface GigabitEthernet 1/1 explicitly tells the Catalyst 3560 to use the IP address of GigabitEthernet 1/1 as the source IP for all TACACS+ packets. This is crucial when the TACACS+ server is configured to only accept requests from specific source IPs. Without this, the switch might use the IP of the outgoing interface, which could vary and lead to authentication failures. The option ip tacacs-server source-interface GigabitEthernet 1/1 is incorrect because tacacs-server is used for defining the server itself, not the source interface for the client. Similarly, ip tacacs source-ip 192.168.100.55 and ip tacacs-server source-ip 192.168.100.55 are incorrect because they attempt to define a static source IP directly, rather than referencing an interface, and the tacacs-server keyword is misplaced in the latter option. The correct syntax for specifying the source interface for TACACS+ client communication is ip tacacs source-interface.