TACACS+ vs RADIUS: Command Authorization and Device Administration

TACACS+ and RADIUS both provide authentication, authorization and accounting, and they are used for different jobs. The short version: TACACS+ for administering network devices, RADIUS for authenticating users and endpoints onto the network. Most well-run networks run both, and knowing why is the exam point.

The architectural difference

RADIUS combines authentication and authorization into a single exchange. When a user authenticates successfully, the accept response carries the authorization attributes with it — one transaction, one decision.

TACACS+ separates all three functions into independent exchanges. Authentication establishes identity. Authorization is then queried separately, and — crucially — can be queried repeatedly during the same session. Accounting is a third independent stream.

That separation is what enables per-command authorization, which is the capability RADIUS structurally cannot provide.

Per-command authorization

With TACACS+, every command an administrator types can be sent to the server for approval before it executes. The server consults policy and returns permit or deny, and the device enforces it.

This allows genuinely granular role definition on shared infrastructure. A junior operator can be permitted show commands and interface descriptions while being denied configuration mode. A network team can be allowed to configure interfaces and routing while being denied access control list changes owned by the security team. A contractor can be scoped to the handful of commands their task requires.

RADIUS can assign a privilege level, and privilege levels are coarse — typically read-only or full administrative, with the middle ground requiring per-device configuration that nobody maintains consistently. With TACACS+ the policy lives centrally and applies everywhere.

The accounting output is correspondingly better: a central log of every command every administrator ran, on which device, at what time. That is an audit trail regulators ask for and a genuinely useful troubleshooting resource — "what changed before this broke" becomes a query. Sending that stream into your SIEM turns it into detection as well, since an administrator running commands outside their normal pattern or outside a change window is worth an alert.

The other differences worth knowing

Transport. TACACS+ uses TCP port 49, which gives reliable delivery and immediate notification of a failed server. RADIUS uses UDP — ports 1812 for authentication and 1813 for accounting, with the older 1645 and 1646 still seen — and relies on timeouts and retransmission.

Encryption. TACACS+ encrypts the entire packet body, so usernames, authorization requests and command text are all protected. RADIUS encrypts only the password field, leaving usernames and attributes in the clear. For a protocol carrying administrative commands, whole-packet encryption is the right property.

Standardization. RADIUS is an open standard with universal support across vendors. TACACS+ originated at Cisco and, while widely implemented and now published as a standard, has historically been less universally supported — worth checking before committing.

Why RADIUS still has the bigger job

RADIUS authenticates users and devices onto the network, which is a far larger population than the handful of people who administer switches. It is the server behind 802.1X port-based authentication for wired and wireless access, behind VPN authentication, and behind enterprise wireless.

It is also what returns the dynamic VLAN assignment that makes role-based network segmentation work. For that job, per-command authorization is irrelevant and universal vendor support is essential.

So the split is by purpose rather than by quality: TACACS+ for the administrative plane, RADIUS for the access plane.

Deployment notes

Deploy redundant servers and configure the fallback behaviour deliberately — a device that cannot reach any AAA server must fall back to a local account, and that local account's password is frequently the weakest credential in the environment. Keep one, make it long and random, store it in a vault, and audit its use, along the lines described under privileged access management.

Protect the AAA servers themselves on the management network, and set strong shared secrets per device rather than one secret reused everywhere. Alert on authentication to network devices from unexpected sources, and on any use of the local fallback account — the latter should be rare enough that every occurrence is investigated.

Exam angles

Know TACACS+ as TCP 49, full packet encryption, and separated AAA enabling per-command authorization — used for network device administration. Know RADIUS as UDP 1812 and 1813, password-only encryption, combined authentication and authorization — used for network access including 802.1X and VPN. When a scenario requires restricting which commands an administrator may run, or a full audit trail of commands, the answer is TACACS+.