AAA · Device admin migration
Move your device-admin AAA between TACACS+ and RADIUS (or the other way). Get the ISE server config outline, Cisco IOS/IOS-XE CLI, fallback to local, and a pilot plan.
TACACS+ is still the gold standard for privileged device admin — per-command authorization, accounting of every keystroke, clear separation of auth/authz/acct. RADIUS is everywhere. Many orgs run both. This tool builds the clean cutover config.
The plan adds the new AAA group in parallel, moves login method list to use new first and old as fallback, validates with a pilot, then removes the old group. At every step, local fallback remains as the safety net.
For network device admin (routers, switches, firewalls), TACACS+ wins on per-command authorization — you can say "user X can run show commands but not config commands" at a granular level. RADIUS can approximate this with privilege level or Cisco AV-Pairs, but it's coarser. For pure authentication (login only), either works. For wireless/wired 802.1X, RADIUS is the only option.
Yes. Many orgs use TACACS+ for admin and RADIUS for 802.1X. ISE supports both simultaneously on the same PSN.
Your method list must end in local or enable. Otherwise, loss of ISE = locked out. Always keep a local emergency account with known password.
Pilot on 5 switches for 2 weeks, monitor accounting. Roll to full fleet in batches of 50 over 1 weekend per batch. Keep ACS as secondary for 30 days, then decommission.
Add TACACS+ servers in ISE PSN. Configure shell profile + command sets. Migrate login method list on Nexus/IOS-XE; keep RADIUS for 802.1X unchanged.