Configuring TACACS+ on an IOS switch

[peanutlife]

I know that we can configure TACACS+ in this order

aaa new-model
aaa authentication login default group tacacs+ local none
aaa authentication enable default none

Where the user is authenticated against TACACS+ server first and if the server is down, local authentication is used.

Is there a way to reverse it ie, if the user is not found in the local config, then the switch talks to TACACS server. If the user is found in the local config, then the switch does not do TACACS+

something like this

aaa authentication login default local group tacacs+

( I know the above does not work).

 

[ADB100]

No. The issue is the local authentication method is always available so there would be no reason to fallback to a 2nd method.