Cisco IOS in a Nutshell, 2nd Edition

Name

tacacs-server last-resort — global

Synopsis

tacacs-server last-resort {password | succeed}
no tacacs-server last-resort {password | succeed}

Configures

Behavior if the TACACS server doesn’t respond

Default

The request is denied

Description

This command sets the router’s behavior when the TACACS servers you have configured don’t respond to a request. For security reasons, the default behavior is to deny the request. The password keyword challenges the user for the enable password before authorizing the action. The succeed keyword simply allows the action, and is discouraged because it blindly allows the user to do what they want without authorization.