What Are RADIUS and TACACS+?

RADIUS and TACACS+ are protocols used to provide centralized authentication and access control for network users and devices.

Instead of storing administrator credentials independently on every router and switch, network devices can communicate with a centralized authentication server.

         User / Administrator
                 |
                 v
         +---------------+
         | Network       |
         | Device        |
         | Switch/Router |
         +---------------+
                 |
                 |
          Authentication
                 |
                 v
         +---------------+
         | AAA Server    |
         | RADIUS /      |
         | TACACS+       |
         +---------------+
    

Why Do We Need Centralized Authentication?

Imagine an organization with:

• 20 Cisco switches
• 10 routers
• 5 firewalls
• Multiple network administrators

If every device stores administrator usernames and passwords independently, managing accounts becomes difficult.

With centralized authentication, administrators can authenticate through a central service.

    Without Centralized Authentication

    Admin
      |
      +---- Switch 1 ---- Local username
      |
      +---- Switch 2 ---- Local username
      |
      +---- Router 1 ---- Local username
      |
      +---- Router 2 ---- Local username


    With Centralized Authentication

                Admin
                  |
                  v
           Network Device
                  |
                  v
             AAA Server
                  |
                  v
          Central User DB
    

What Is RADIUS?

RADIUS stands for Remote Authentication Dial-In User Service.

RADIUS is widely used for centralized authentication and network access control.

Common examples include:

• Enterprise Wi-Fi authentication
• VPN authentication
• Network Access Control
• 802.1X authentication
• Remote network access

How Does RADIUS Work?

A simplified RADIUS authentication flow looks like this:

    User
      |
      | Login
      v
    Switch / AP / VPN
      |
      | RADIUS Request
      v
    RADIUS Server
      |
      | Check credentials
      v
    User Database
      |
      | Accept / Reject
      v
    RADIUS Server
      |
      | Response
      v
    Network Device
      |
      v
    Access Granted / Denied
    

The network device acts as the client of the RADIUS server. Depending on the deployment, the device may be a switch, wireless controller/access point, VPN gateway, or another network access device.

RADIUS and 802.1X

RADIUS is commonly used as the backend authentication protocol in 802.1X deployments.

    Laptop
    Supplicant
        |
        | EAPOL
        v
    Switch
    Authenticator
        |
        | RADIUS
        v
    RADIUS Server
    Authentication Server
    

Remember the three major 802.1X roles:

• Supplicant – client device
• Authenticator – switch or wireless infrastructure
• Authentication Server – commonly RADIUS

What Is TACACS+?

TACACS+ stands for Terminal Access Controller Access-Control System Plus.

TACACS+ is commonly used for centralized authentication and authorization of administrators accessing network infrastructure.

It is especially common in environments where organizations need detailed control over what network administrators are allowed to do.

Where Is TACACS+ Commonly Used?

• Cisco routers
• Cisco switches
• Network management systems
• Firewall administration
• Administrator login control
• Command-level authorization

For example, an organization may allow one administrator to run monitoring commands while allowing a senior network engineer to configure routing protocols.

RADIUS vs TACACS+ — The Big Difference

One of the most important differences is how they handle authentication and authorization.

RADIUS Uses UDP

RADIUS commonly uses:

• UDP 1812 – authentication and authorization
• UDP 1813 – accounting

Older RADIUS deployments may use UDP 1645 and 1646.

TACACS+ Uses TCP

TACACS+ commonly uses TCP port 49.

TACACS+ separates authentication, authorization, and accounting functions more distinctly, which is useful for administrative access control.

Authentication vs Authorization

These two terms are very important.

Authentication

Authentication answers:

"Who are you?"

Authorization

Authorization answers:

"What are you allowed to do?"

For example:

    Administrator logs in
            |
            v
    Authentication
            |
            v
    "Is this really admin01?"
            |
            v
    Authorization
            |
            v
    "What commands can admin01 execute?"
    

Why TACACS+ Is Popular for Network Administrators

Consider three administrators:

• Junior Network Administrator
• Network Engineer
• Senior Network Engineer

An organization may want different permissions for each person.

TACACS+ can be useful for implementing this kind of centralized administrator authorization, depending on the network device and AAA server capabilities.

Example: Cisco Device Using TACACS+

A simplified Cisco configuration may look like:

```

aaa new-model

tacacs server TACACS-SERVER
address ipv4 192.168.100.10
key YOUR_SECRET

aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local 

The exact syntax can vary between Cisco IOS versions and platforms, so always check the platform-specific documentation.

Example: Cisco Device Using RADIUS

```

aaa new-model

radius server RADIUS-SERVER
address ipv4 192.168.100.20 auth-port 1812 acct-port 1813
key YOUR_SECRET

aaa authentication login default group radius local 

The local method can provide a fallback account if the centralized authentication server is unavailable, depending on the configured method list and device behavior.

What Happens If the AAA Server Goes Down?

This is an important real-world design consideration.

         Administrator
              |
              v
         Network Device
              |
              X
         AAA Server DOWN
              |
              v
         Authentication fails
    

Network administrators commonly configure a local fallback account for emergency access.

```

aaa authentication login default group tacacs+ local 

This means the device can try the centralized AAA service first and use the local method according to the configured method list and failure behavior.

RADIUS vs TACACS+ — Simple Memory Trick

For interview preparation, remember:

    RADIUS
    ↓
    Network Access
    Wi-Fi
    VPN
    802.1X


    TACACS+
    ↓
    Network Administration
    Routers
    Switches
    Command Authorization
    

This is a useful rule of thumb, although real deployments can support broader use cases.

RADIUS vs TACACS+ Interview Questions

Practical Lab Idea

You can build a small centralized authentication lab using:

• 1 Cisco router
• 1 Cisco switch
• 1 AAA server
• 1 administrator PC

Practice the following:

1. Create a user on the AAA server.
2. Configure the network device to communicate with the server.
3. Configure AAA authentication.
4. Test administrator login.
5. Configure a local fallback account.
6. Test what happens when the AAA server is unavailable.

Key Takeaways

• RADIUS and TACACS+ provide centralized AAA capabilities.
• RADIUS is widely used for network access such as Wi-Fi, VPN and 802.1X.
• TACACS+ is commonly used for network device administration.
• RADIUS commonly uses UDP 1812/1813.
• TACACS+ commonly uses TCP 49.
• Authentication asks "Who are you?"
• Authorization asks "What are you allowed to do?"
• Accounting records access or activity information.
• Local fallback access can be important for emergency administration.