What Is RADIUS vs TACACS+ in Networking?

Imagine you work in a large office building with many different rooms, some of which contain sensitive information. To get into the building, you need to show your ID card to a guard at the front desk. That guard checks a list to see if you are an employee. Once you are inside, you might need a different key or badge to enter the server room, the accounting office, or the executive suite. RADIUS and TACACS+ are like two different systems that handle this process for a computer network.

RADIUS is like a combined guard and rule-maker. When you try to log into a network, RADIUS checks your username and password against a central database. If the credentials are correct, RADIUS also tells the network what you are allowed to do, like which files you can open or which websites you can visit. It does everything in one communication, which makes it fast but less flexible if you want to change just the password without changing permissions.

TACACS+ is like a security system that separates the tasks. First, it checks if you are who you say you are. Then, separately, it decides what you are allowed to do. This separation means you can change your password without affecting your permissions, or you can change what you are allowed to do without touching your password. TACACS+ also keeps a detailed log of every command you type on a network device, like a router or switch. This makes it very popular for managing network equipment, especially in large companies that use Cisco devices.

Both protocols help network administrators control who gets into the network and what they can do once inside. The choice between them depends on what the network needs. If you need speed and simplicity for many users accessing a service like Wi-Fi, RADIUS is common. If you need detailed control over who can run specific commands on a router, and you want a complete record of everything they do, TACACS+ is usually the better choice.

RADIUS, which stands for Remote Authentication Dial-In User Service, and TACACS+, which stands for Terminal Access Controller Access-Control System Plus, are both AAA protocols. AAA stands for Authentication, Authorization, and Accounting. These three functions are the core of network access control: Authentication verifies who you are, Authorization determines what you are allowed to do, and Accounting records what you did.

RADIUS was originally designed by Livingston Enterprises for dial-up connections and later standardized by the IETF in RFC 2865 and RFC 2866. It uses UDP as its transport protocol, typically on ports 1812 for authentication and 1813 for accounting. Because it uses UDP, RADIUS is connectionless and has less overhead, but it also means the protocol must handle retransmissions and timeouts on its own. RADIUS encrypts only the password field in the access-request packet, leaving other parts of the packet, such as the username and the service being requested, in plain text. This is a notable security limitation. The encryption of the password uses a shared secret and the MD5 hash algorithm. In terms of AAA, RADIUS combines authentication and authorization into one step. The server sends back an access-accept message that includes authorization attributes, such as the IP address to assign, the allowed services, and session timeout values. RADIUS is widely used for network access control, especially for wireless networks, VPNs, and broadband remote access.

TACACS+ is a Cisco-proprietary protocol, though it is documented in various Cisco publications. It is an evolution of the original TACACS and extended TACACS (XTACACS). TACACS+ uses TCP as its transport protocol, typically on port 49. Because TCP is connection-oriented, TACACS+ provides reliable delivery and built-in flow control. In TACACS+, the entire body of the packet is encrypted, not just the password. This provides much stronger security for all communication between the client and the server. The encryption uses a shared secret and a proprietary algorithm based on MD5. The most significant architectural difference is that TACACS+ separates authentication, authorization, and accounting into three distinct processes. Each function can use different servers or databases if needed. For example, authentication could be done against Active Directory, while authorization could use a separate local database on the TACACS+ server. This separation gives network administrators granular control over command-level authorization. TACACS+ can authorize individual commands typed on a network device, allowing or denying each command based on the user's role. It also provides detailed accounting records, logging every command entered, along with timestamps and the device on which it was executed.

In real IT environments, RADIUS is commonly used in scenarios involving many users accessing a network service, such as wireless LAN authentication using 802.1X. TACACS+ is more often found in network device management, where administrators need to control who can configure routers, switches, and firewalls. Cisco’s Identity Services Engine (ISE) can act as both a RADIUS and TACACS+ server, allowing organizations to use a single platform for both network access control and device administration.

In real IT work, especially in enterprise networking, cybersecurity, and system administration, the ability to control who accesses network resources and what they do with them is a fundamental security requirement. RADIUS and TACACS+ are the two primary protocols that make this possible in most medium to large networks. Understanding the difference between them is not just academic; it directly affects security posture, operational efficiency, and compliance with regulations.

For networking professionals, choosing between RADIUS and TACACS+ impacts how they manage user access. If you are setting up a corporate Wi-Fi network that thousands of employees will use, RADIUS is typically the right choice. It integrates well with 802.1X, which is the standard for port-based network access control. Many RADIUS servers can also handle dynamic VLAN assignment and policy enforcement, such as redirecting guest users to a captive portal. For example, a hospital might use RADIUS to ensure that only doctors on the surgical team can access the operating room network segment.

TACACS+ is indispensable for managing network devices themselves. In a large enterprise, dozens or hundreds of routers, switches, and firewalls need to be configured and maintained. Network administrators need to log into these devices to make changes. TACACS+ provides command-level authorization, meaning you can allow a junior engineer to type only certain commands, such as show commands, while denying them the ability to change running configurations. This level of granularity is crucial for preventing accidental or malicious misconfigurations that could cause network outages. The accounting function of TACACS+ also creates an audit trail. If a change causes a problem, you can see exactly who made the change, on which device, at what time, and what commands they typed. This is invaluable for troubleshooting and for meeting compliance requirements like PCI-DSS, HIPAA, or SOX.

In cloud infrastructure, both protocols play a role. Cloud-based network devices and VPN concentrators often support RADIUS for user authentication. TACACS+ is less common in the cloud but is still used for managing cloud-hosted network appliances when they are part of a hybrid environment. Understanding both protocols helps IT professionals design secure, auditable, and manageable networks.

Exam questions about RADIUS and TACACS+ appear in several formats. The most common are direct comparison questions. These ask you to identify a specific feature of one protocol versus the other. For example, Which protocol encrypts only the password? The correct answer is RADIUS, while TACACS+ encrypts the entire packet body. Another common question: Which protocol uses TCP? TACACS+ uses TCP, while RADIUS uses UDP. These are straightforward but require memorization of the key differences.

Scenario-based questions present a network situation and ask you to choose the best protocol or identify a correct statement. For example, a question describes a company that wants to control which commands each administrator can type on routers and needs a detailed audit log of every command entered. The correct answer would be TACACS+, because it supports command-level authorization and detailed accounting. In another scenario, a company needs to authenticate thousands of wireless users quickly and efficiently. The best choice is RADIUS because it is lightweight, uses UDP, and is well-suited for high-volume network access.

Configuration questions may present a configuration snippet with blank spaces or incorrect parameters. You might be asked to fill in the missing protocol keyword, either RADIUS or TACACS+, or to identify which command is used to enable AAA with a specific protocol. For example, the command aaa authentication login default group radius would show that RADIUS is being used. A question might ask what the next step would be in configuring TACACS+.

Troubleshooting questions involve reading a scenario where authentication is failing. You might need to determine that the issue is a mismatched shared secret, or that TACACS+ is not working because TCP port 49 is blocked by a firewall. You must also understand that RADIUS uses UDP, so a firewall rule allowing UDP on port 1812 and 1813 is necessary.

Architecture questions might ask about the logical separation of AAA functions. For example, which protocol allows authentication and authorization to be handled by separate servers? TACACS+ allows this because the functions are distinct processes. RADIUS does not, as authentication and authorization are bundled into the same response.

Finally, some questions test knowledge of encryption. RADIUS encrypts only the password using MD5 and a shared secret. TACACS+ encrypts the entire packet body. A question might ask: Which statement accurately describes the encryption of each protocol?

To understand how RADIUS and TACACS+ work in practice, imagine you are a network administrator setting up AAA for a medium-sized enterprise. You will likely need both protocols, each for different purposes.

First, configure a RADIUS server for network access. Users connecting to the corporate Wi-Fi will authenticate through the wireless LAN controller (WLC). You set up a RADIUS server, often a free one like FreeRADIUS, or a commercial solution like Cisco ISE. On the WLC, you configure the RADIUS server IP address, shared secret, and UDP ports 1812 and 1813. You create a policy that maps users to VLANs based on their Active Directory group. For example, employees from the finance department get a VLAN that grants access to accounting servers. When a user logs in, the WLC sends a RADIUS Access-Request. The server checks against AD, finds the user is in the finance group, and sends back an Access-Accept with the attribute that assigns the finance VLAN. The user gets on the network. This is fast and works well for many users.

Second, configure a TACACS+ server, possibly the same ISE instance, for device management. You configure the Cisco routers and switches to use TACACS+ for login authentication. On each device, you enter global configuration mode and use commands like aaa new-model, then aaa authentication login default group tacacs+, and then tacacs-server host 10.1.1.100 key MySecretKey. You also configure authorization and accounting. For authorization, you use aaa authorization exec default group tacacs+ to control which administrators get privileged EXEC access, and aaa authorization commands 0 default group tacacs+ to authorize user-level commands. For command authorization at privilege level 15, you use commands 15. For accounting, you use aaa accounting exec default start-stop group tacacs+ and aaa accounting commands 0 default start-stop group tacacs+ to log all commands.

On the TACACS+ server, you create a user profile for a junior technician named Bob. Bob is allowed only to use show commands, not configure anything. When Bob logs into a switch, the switch sends a TACACS+ authentication request. The server authenticates Bob and returns a success. Bob is now at the user EXEC prompt. He types show running-config. The switch sends a TACACS+ authorization request for that specific command. The server checks Bob's profile, sees that show commands are allowed, and returns an accept. Bob sees the configuration. Bob types configure terminal. The switch sends another authorization request. The server checks and sees configure commands are not in Bob's allowed list, so it denies the request. The switch rejects the command and shows an error. The TACACS+ server also logs both the allowed and denied commands. This level of control prevents junior staff from accidentally breaking network configurations.

A common problem is mismatched shared secrets. If the RADIUS or TACACS+ client and server have different shared secrets, authentication will fail. Always double-check the secret on both sides. Another issue is firewall rules. Since RADIUS uses UDP, it is more prone to packet loss and requires the firewall to allow UDP ports 1812 and 1813. TACACS+ uses TCP, so it requires TCP port 49 to be open. If authentication times out, check the firewall first.

In practice, Cisco ISE can serve both roles, making it a unified platform for network access and device management. Understanding how to configure and troubleshoot both protocols is a core skill for any network professional aiming for CCNP or security certifications.