Key Points
- A TACACS server is a centralized AAA server used to control administrative access to network devices.
- TACACS+ is the modern version of TACACS, offering full packet encryption and separation of AAA functions.
- For end-user authentication on WPA2 or VPN networks, a cloud RADIUS server complements a TACACS+ setup.
Network infrastructure security is complex, requiring complete control over a growing array of devices and users. TACACS is a protocol used to centralize authentication, authorization, and accounting (AAA) for administrative access to network infrastructure devices.
Here’s what TACACS servers are, the differences between TACACS, TACACS+, and RADIUS, and how to structure a comprehensive security strategy that covers you end-to-end, from administrators to end users.
What Is a TACACS Server?
A TACACS server is a centralized authentication, authorization, and accounting (AAA) server that controls administrative access to network devices such as routers, switches, and firewalls.
TACACS stands for Terminal Access Controller Access-Control System. It’s a network security protocol focused on device administration, providing centralized authentication, authorization, and accounting (AAA) for administrative devices seeking network access.
How Does a TACACS+ Server Work?
A user attempts to connect to the TACACS+ server host through a router or other network device. The device asks for a username and password, then passes the authentication request and user credentials to the server. Upon successful credential verification, authorization is checked to determine if the user has the necessary privileges. Finally, the server stores details of the exchange, including username, identity, user activities, and timestamps.
Is a TACACS Server Different From a TACACS+ Server?
Yes, they differ significantly. TACACS was the original standard for authentication and access control. However, as the technology evolved, Cisco introduced and documented TACACS+ through the Internet Engineering Task Force in the 1990s.
Key improvements include enhanced encryption for entire packets, support for two-factor authentication (2FA) and multi-factor authentication (MFA), and advanced Transmission Control Protocol (TCP) for reliable communication.
Is TACACS Obsolete?
The original TACACS protocol of the 1980s is obsolete. It doesn’t meet modern standards for encryption, and most of Cisco’s tools no longer support commands for this outdated server. However, TACACS+ certainly isn’t; it’s still in use today.
The lineage is worth knowing for context. The original TACACS was developed in 1984 by BBN Technologies for ARPANET administration. Cisco extended it as XTACACS in 1990, then built TACACS+ as an entirely new, incompatible protocol in the early 1990s.
TACACS+ was later published as an open standard in RFC 8907, so while it is Cisco-developed and most associated with Cisco environments, it is no longer a closed proprietary specification.
Top 6 Features of TACACS+ Servers
- Separate AAA Functions: Cisco created TACACS+ around the authentication, authorization, and accounting (AAA) framework, with a unique twist: each element is distinct and separate.
- Centralized Authentication: TACACS+ uses an AAA server with a centralized authentication process for simple management.
- Granular Access Controls: TACACS+ offers a high degree of flexibility for managing device access. Managers can enforce command-level authorization on network devices.
- Detailed Auditing: TACACS+ is good for monitoring, logging, and troubleshooting purposes, including user credentials, user activities, and time of access, providing detailed logs that improve compliance.
- Enhanced Security: TACACS+ encrypts the entire payload, keeping sensitive information secure. With reliable, comprehensive encryption and the reliable Transmission Control Protocol (TCP), TACACS+ offers secure communication.
- Scalability: TACACS+ is designed for large Cisco networks. It offers flexibility and scalability for a growing number of devices and administrative users.
Why Use a TACACS Server? Common Use Cases
- Network Device Administration: Administrative management for routers, switches, firewalls, and user devices.
- Role-Based Command Authorization: Industries requiring fine-tuned access controls rely on TACACS+ for customization and flexibility.
- Accounting and Auditing: Centralized management simplifies logging, access to, and auditing of admin and user actions.
- High-Budget Industries: Industries such as finance and defense often have huge budgets, giving them the leeway to purchase and maintain on-premise servers.
TACACS doesn’t manage end-user access for public networks. It handles the authentication, authorization, and accounting of administrative devices.
9 Key Differences Between TACACS+ Servers and RADIUS Servers
- Proprietary vs. Open: TACACS+ natively supports Cisco devices, creating potential licensing costs and incompatibility with other devices; RADIUS is an open standard protocol compatible with all modern devices.
- Protocol Type: TACACS+ is a device administration protocol for internal administrative devices on access control server (ACS) servers; RADIUS is a broader network access protocol authenticating end users.
- Communication Speed: TACACS+ is more computationally demanding for servers, resulting in slower communication compared to RADIUS.
- Encryption: TACACS+ encrypts entire data packets; many RADIUS servers encrypt only the password in the access-request packet.
- Security: While both TACACS+ and RADIUS are susceptible to brute-force and other attacks, setup and implementation are key — RADIUS is typically easier to set up and configure.
- Transport Layer Protocol: TACACS+ uses the Transmission Control Protocol (TCP), while RADIUS uses the User Datagram Protocol (UDP).
- Access Control: TACACS+ typically provides more fine-grained control compared to RADIUS, including command-level restrictions.
- Accounting Records: TACACS+ offers detailed accounting, but not as detailed or robust as the audit and accounting processes of RADIUS.
- Wireless Authentication: TACACS+ doesn’t support 1X port-based network access control, posing wireless security risks; RADIUS supports 802.1X, making it a more secure choice for authentication on modern WPA2-Enterprise networks.
See the following comparison table to see how TACACS+ servers and RADIUS servers stack up.
| Attribute | TACACS+ Server | RADIUS Server |
| Origin | Cisco-developed, now open via RFC 8907 | Open standard (RFC 2865) |
| Transport protocol | TCP (port 49) | UDP |
| Encryption | Encrypts the full packet body | Encrypts only the password field |
| AAA handling | Authentication, authorization, and accounting separated | Authentication and authorization combined |
| Primary use | Network device administration | End-user network access |
| 802.1X / wireless | Not supported | Supported |
| Walk through the platform on your own terms. |
| Explore SecureW2 features at your own pace with a self-guided product tour — no sales call required. |
| Take a Free Product Tour → |
How to Set Up TACACS Servers
Setting up a TACACS server involves a handful of core steps on the network devices that will use it:
- Identify the server host(s): Point the network device at the IP address of the TACACS+ server (or servers, for redundancy).
- Choose a TACACS server key: Configure the shared secret that encrypts traffic between the device and the server.
- Configure AAA server groups: Group your TACACS+ servers so devices can fail over between them.
- Specify TACACS authentication, authorization, and accounting: Designate TACACS+ as the method for all three validation steps. What Is the Best TACACS Server Setup?
The best, most secure TACACS server setup requires a trusted provider and two or more dedicated, hardened virtual machines (VMs) and/or bare metal servers to maximize security and uptime.
Implementation should enable encryption, implement granular role-based access control, integrate directories for centralized management, document all policies and procedures, and conduct regular testing.
Limitations and Challenges of TACACS Servers
TACACS servers solve device administration well, but they come with trade-offs that shape where they fit in a network.
- Vendor association: While TACACS+ is now an open standard (RFC 8907), it is most at home in Cisco environments. Integration concerns include compatibility with non-Cisco devices and the need for additional customization and configuration.
- Support for multiple authentication servers: TACACS lacks native support for multiple authentication servers. But additional network device configuration, such as utilizing server groups or defining backup servers, can make this implementation possible.
- Single point of failure: A TACACS server sits in the path of every administrative login, so a single un-redundant server can lock administrators out of network gear if it goes down. Deploying two or more servers mitigates this.
- Configuration complexity: Per-command authorization and separated AAA give granular control, but they also require more in-depth configuration.
- Performance overhead: Encrypting the full packet body and running each command through the server adds processing cost, which is why TACACS+ communication is slower than RADIUS.
Beyond TACACS: Adding RADIUS for End-User Access
TACACS is a device administration protocol that secures administrative device requests, not end users. For comprehensive network validation, most modern networks require identity-based access to authenticate users, which protocols like RADIUS can provide.
For reliable high-security environments, consider a hybrid approach: TACACS for administrative management and RADIUS for managing user access.
Secure End-User Access Alongside Your TACACS Server
A TACACS server locks down who can administer your network gear, but it leaves end-user access to your Wi-Fi and VPN unaddressed. JoinNow Cloud RADIUS from SecureW2 offers advanced user and device authentication using reliable AAA methods to keep your devices, users, and networks compliant and secure. Pair it with JoinNow Dynamic public key infrastructure (PKI) for certificate-based authentication across your full network. Schedule a demo today to see how JoinNow Cloud RADIUS complements a TACACS server with end-user authentication for WPA2 and VPN networks.
Frequently Asked Questions
What is a TACACS server?
A TACACS server is a centralized authentication server that processes AAA (authentication, authorization, and accounting) requests from network devices. It is used primarily to control administrative access to routers, switches, and other network infrastructure.
Is TACACS the same as RADIUS?
No. TACACS and RADIUS are both AAA protocols, but they serve different purposes. TACACS is a device administration protocol focused on controlling administrative access to network hardware. RADIUS is a network access protocol that authenticates end users connecting to Wi-Fi, VPNs, and other network services.
What is the difference between TACACS+ and RADIUS?
The main differences are: TACACS+ is Cisco-proprietary and encrypts the full packet, while RADIUS is an open standard and typically encrypts only the password. TACACS+ uses TCP, while RADIUS uses UDP. TACACS+ provides command-level authorization for device administration, while RADIUS handles broader end-user network access and supports 802.1X wireless authentication.
What port does TACACS+ use?
TACACS+ uses TCP port 49 for all communication between the client device and the TACACS+ server.
Is TACACS+ obsolete?
The original TACACS protocol (1980s) is obsolete. TACACS+, introduced by Cisco in the 1990s, is not obsolete and remains in active use in Cisco network environments for administrative device access control.
Does TACACS use TCP or UDP?
TACACS+ uses TCP (Transmission Control Protocol), specifically TCP port 49. This differs from RADIUS, which uses UDP (User Datagram Protocol). TCP provides more reliable, connection-oriented communication, which contributes to TACACS+’s stronger error-handling capabilities.
