Internal Auditing wants us to start using TACACS for authentication but I believe local accounts will cease to function once TACACS is used. My concern is remote support with EMC thru ESRS. If they needed to log into our switches during a support call, what would be the best way to allow this? Will the admin account still function? We certainly aren't going to create an Active Directory account for EMC so I'm just curious how other customers handle this scenario when running TACACS.

Also, if we loose the ACS server or Active Directory goes down and MDS users cannot authenticate via TACACS, will it allow local account access automatically or do I have to disable TACACS on all our switches?