An engineer configured a Cisco AireOS controller with two TACACS+ servers. The engineer notices that when the primary TACACS+ server fails, the WLC…

The behavior described, where the Cisco AireOS Wireless LAN Controller (WLC) fails over to a secondary TACACS+ server but does not return to the primary server after it recovers, is the direct result of the TACACS+ fallback mechanism being disabled. When the fallback mode is set to 'off' (the default setting), the WLC will "stick" to the currently active server. It will only attempt to use the primary server again if the secondary server fails or the controller is rebooted. Enabling fallback (in passive or aggressive mode) would allow the WLC to preemptively switch back to the recovered primary server.

A. Fallback is enabled: If fallback were enabled, the controller would actively or passively check for the primary server's recovery and switch back, which contradicts the behavior described in the scenario.

C. DNS query is disabled: DNS is used for resolving server hostnames to IP addresses. This setting does not control the failover or failback logic between already-defined servers.

D. DNS query is enabled: Similar to option C, enabling or disabling DNS does not influence the controller's server preemption and selection logic after a failure event.

1. Cisco Wireless Controller Configuration Guide

Release 8.5

"Configuring TACACS+ (CLI)" section: This guide details the config tacacs fallback-mode command. It explicitly states for the off parameter: "Disables the fallback mechanism. The controller uses the secondary server only when the primary server fails. The controller switches back to the primary server only when the secondary server fails or the controller is rebooted. This is the default value." This directly confirms that disabling fallback causes the exact issue described.

2. Cisco Wireless LAN Controller (WLC) Configuration Best Practices

"AAA" section: This document often reiterates best practices for high availability. It explains that for automatic recovery to the primary AAA server

the fallback feature must be enabled from its default 'off' state to either 'passive' or 'aggressive' mode.