Primary source: NetApp Knowledge Base — “Is TACACS+ supported on Metrocluster-IP switches?”, published and last updated 2026-10-13.
MetroCluster IP Cisco TACACS+ 2026-10-14What NetApp confirmed
NetApp's answer is direct: TACACS+ is supported on the switches because enabling it should not affect their functional capabilities. The article's Applies-to section names exactly two things: MetroCluster IP and Cisco MetroCluster IP switches.
The timing and scope matter. The KB was published at 07:16 UTC on October 13, 2026 and updated less than a minute later. It names no ONTAP release, switch model, NX-OS release, reference configuration file, or TACACS+ server product. This is a support-position clarification—not an ONTAP release announcement and not a complete implementation runbook.
What changes for MetroCluster IP operators
Teams running supported Cisco MetroCluster IP switches now have a public NetApp statement they can use when deciding whether centralized switch administrator authentication conflicts with MetroCluster support. That closes the narrow support question; it does not remove the need to validate the switch configuration.
- Scope the change to management-plane access. TACACS+ controls administrator authentication, authorization and accounting. The KB says it should not affect switch functionality; it does not authorize changes to MetroCluster VLANs, interfaces, ISLs, routing, QoS or reference configuration settings.
- Preserve recovery access. Before changing authentication, document and test an approved fallback path for a TACACS+ server or management-network outage. The KB provides no fallback procedure.
- Validate the exact platform combination. Record the Cisco switch model, firmware and NetApp reference configuration file in the change plan, then check them against the current MetroCluster documentation and interoperability requirements.
- Keep before-and-after evidence. Capture successful local and TACACS+ logins plus MetroCluster and switch health before considering the change complete.
For the architecture and disaster-recovery context around those switches, see the MetroCluster fundamentals guide. For fault isolation after a fabric or quorum event, use the MetroCluster troubleshooting runbook.
What this means for ONTAP, StorageGRID and BlueXP
| Product | Change from this KB | Reason |
|---|---|---|
| ONTAP / MetroCluster IP | Switch-management support clarification only | The KB names the Cisco MetroCluster IP switches, not an ONTAP release or ONTAP authentication command. |
| StorageGRID | None stated | StorageGRID is outside the Applies-to section. |
| BlueXP / NetApp Console | None stated | The article does not discuss BlueXP, Console or cloud service authentication. |
In particular, do not read this KB as evidence that TACACS+ was added to ONTAP itself. The statement is about the Cisco switches used by MetroCluster IP.
What to watch next
The public answer is useful but leaves implementation details open. Operators should watch for NetApp adding supported switch models, NX-OS versions, configuration examples, a tested fallback pattern, or a link to Cisco guidance. Any later expansion of the Applies-to section to non-Cisco MetroCluster IP switches would also be material; until then, the answer should not be generalized beyond Cisco.
Bottom line
NetApp's official position is now unambiguous but narrow: TACACS+ is supported on Cisco MetroCluster IP switches and should not impair their functional capabilities. Treat it as permission to design and validate centralized switch access—not as a ready-made configuration or a product-wide TACACS+ announcement.