What is TACACS and How Does it Work? TACACS vs. TACACS+

TACACS (Terminal Access Controller Access-Control System) is a family of related protocols that network administrators use to control who can log in to routers, switches, and firewalls. If your team manages network infrastructure and relies on shared device passwords, TACACS+ is likely part of the picture, and so are its limits.

What Is TACACS?

TACACS (Terminal Access Controller Access-Control System) is a family of related network authentication protocols handling remote authentication and related services for network access control through a centralized server.

TACACS centralizes administrator login verification for infrastructure devices like routers, switches, and firewalls.

What Is TACACS Used For?

The protocol handles administrator login verification, device access logging, centralized credential management, and remote management authorization.

In practice, TACACS+ is deployed specifically for device administration, controlling which network engineers can log in to which routers, switches, or firewalls, and what commands they are permitted to run once logged in.

This is distinct from controlling which end users or devices can join the network, which is the domain of RADIUS. The AAA framework (Authentication, Authorization, and Accounting) is the conceptual backbone of TACACS+: authentication confirms identity, authorization defines what actions are allowed, and accounting logs every command executed for audit purposes.

How Does TACACS Work?

When an administrator attempts to access a network device, the device forwards the login request to a TACACS server over TCP port 49. The server verifies credentials and returns an allow or deny response, removing the need for locally stored passwords.

The process follows three sequential AAA steps:

1. Authentication: The network device (the client) forwards the administrator’s login credentials to the TACACS+ server over TCP port 49. The server checks the credentials against its user database and responds with an allow or deny.
2. Authorization: Once authenticated, the server evaluates the administrator’s assigned privilege level and returns a list of permitted commands or actions for that session.
3. Accounting: The TACACS+ server logs the session start, duration, commands executed, and session end. This creates an audit trail for every administrative action on every managed device.

Using TCP rather than UDP gives TACACS+ a reliable transport layer. Dropped packets are retransmitted, so authentication failures caused by network noise are less common than with UDP-based protocols.

TACACS vs. TACACS+: Key Differences

TACACS+ is a complete redesign of the original TACACS protocol, not a simple version increment. The original TACACS only encrypted passwords; TACACS+ encrypts the entire authentication packet. The original merged authentication and authorization into a single operation; TACACS+ separates all three AAA functions, giving administrators granular control over each independently. TACACS+ is now the standard for device administration, while the original TACACS is rarely deployed.

This table explains the most important differences between TACACS and TACACS+.

Advantages of TACACS+

TACACS+ has remained in use for device administration because it offers capabilities that simpler authentication protocols do not:

• Full packet encryption: Unlike the original TACACS, TACACS+ encrypts the entire communication between the network device and the authentication server, not just the password field.
• Granular command authorization: TACACS+ can enforce per-command authorization, meaning an administrator can be permitted to run show commands but blocked from configure commands on specific devices.
• Separated AAA functions: Because authentication, authorization, and accounting are handled independently, each can be configured separately. An organization can use TACACS+ for authorization and accounting while delegating authentication to a different directory service.
• TCP reliability: TACACS+ uses TCP port 49, giving it a reliable transport layer with retransmission. Failed authentication events are less likely to be caused by transport-layer packet loss.
• Centralized policy management: All device access policies live on the TACACS+ server, so revoking an administrator’s access requires a single change at the server rather than updates on every managed device.

TACACS vs. RADIUS: Which Should You Use?

TACACS+ and RADIUS are both AAA protocols, but they solve different problems and rarely compete directly for the same use case.

TACACS+ is the right choice when the goal is controlling what network engineers can do on managed infrastructure devices. RADIUS is the right choice when the goal is controlling which users and devices can access the network, including Wi-Fi authentication via 802.1X , VPN access, and wired port authentication.

Many enterprise networks run both: TACACS+ handles administrator access to network devices, while RADIUS handles end-user and endpoint access to the network itself. The two protocols complement rather than replace each other.

TACACS+ Limitations and Modern Network Security

The TACACS+ protocol relies heavily on usernames and passwords, lacks device identity verification, and offers limited encryption. The protocol also struggles in distributed cloud environments and remote user scenarios.

These limitations matter in environments that have moved beyond traditional perimeter security. For example, an attacker using stolen credentials can authenticate just as easily as a legitimate network engineer, because TACACS+ has no mechanism to verify whether the device being used to log in is a trusted, managed endpoint.

Certificate-based authentication addresses this gap. By deploying a dynamic PKI that issues device certificates to every managed endpoint, organizations can enforce the principle that administrative access requires both a valid credential and a verified device identity. This is the architecture behind modern zero-trust network access policies.

For network access control beyond device administration, Cloud RADIUS provides a RADIUS-as-a-Service platform that supports certificate-based authentication natively, removing the dependency on shared passwords for both end users and administrators.

Move Beyond Password-Based Device Authentication with SecureW2

TACACS+ centralizes device administration access, but its reliance on passwords leaves a gap that modern network environments cannot afford to ignore. SecureW2 helps organizations replace password-based authentication with certificate-based identity verification, for both network access and device administration workflows.

Schedule a demo to see how certificate-based authentication works with your existing network infrastructure.