TACACS+ Explained: Protocol, Authentication & When to Use

When people think about network security, they usually think about protecting users. But what about the people managing the network itself?

Network administrators have access to routers, switches, firewalls and other critical infrastructure. If those accounts are compromised, attackers can make configuration changes, disable security controls or move deeper into the network.

That’s why organizations use TACACS+, a protocol built specifically to secure administrative access.

In this guide, we’ll explain:

• How TACACS+ works
• Key features
• How it differs from RADIUS
• Where it fits into a modern identity-based security strategy

What is TACACS+?

Terminal Access Controller Access-Control System Plus (TACACS+) is a centralized authentication protocol used to control administrator access to network infrastructure devices.

TACACS+ includes authentication, authorization, and accounting (AAA) services, but unlike the original TACACS protocol, TACACS+ separates each AAA step into distinct functions for greater control.

Instead of storing administrator accounts locally on each separate network device (router, switch or firewall), the devices rely on a dedicated authentication server to validate login attempts and determine permissions.

TACACS+ obfuscates the body of each access release packet (not just the credentials). The architecture uses Transmission Control Protocol (TCP) port 49 for reliable delivery. It’s important to note that the packet header is not obfuscated, and RFC 8907 does not classify the mechanism as encryption.

Info: TACACS+ evolved from earlier TACACS implementations to provide improved security and a clear division between authentication, authorization and accounting functions.

The TACACS+ Protocol Explained

The TACACS+ protocol improves upon the original TACACS by separating three critical vital functions:

1. Authentication
2. Authorization
3. Accounting

This separation allows organizations to verify identities, restrict privileges and record administrative activity in a consistent, auditable manner.

Unlike simple login verification, TACACS+ gives network administrators precise control over who can access infrastructure devices and what they can do once connected. This structured approach helps prevent unauthorized configuration changes while giving administrators the appropriate level of access for their specific roles.

Authentication

Authentication verifies the identity of the administrator attempting to log in.

When a user enters credentials, the network device forwards the request to the TACACS+ server, which validates credentials against a centralized identity store such as Lightweight Directory Access Protocol (LDAP), Active Directory (AD) or a local database. Only after the server confirms the administrator’s identity is access allowed to proceed to the next stage.

The authentication process prevents unauthorized users from accessing management interfaces and ensures that every administrative session is tied to a specific, accountable individual.

Authorization

Authorization determines which commands or configuration changes the administrator can perform after successfully logging in.

Once identity is verified, the TACACS+ server applies role-based permissions that define which management functions and command-line interface (CLI) commands are permitted.

An administrator may be allowed to view device status, configure specific interfaces or update security policies depending on their assigned role.

For example:

• A network engineer may configure interfaces
• A security engineer may update firewall policies
• A junior technician may only view status information

In restricting actions rather than only granting full access, authorization reduces the risk of accidental misconfiguration and limits the impact of compromised credentials.

Accounting

Accounting records the actions performed after login and creates a detailed audit trail of administrative activity.

The TACACS+ server logs session start and end times, commands executed and configuration changes made on the device. These records allow security and operations teams to review who accessed a system and what they did during the session.

A really important part about TACACS+ is it’s helpful for network forensics. It’s going to log every single time someone’s made a change on the network.

As you could imagine, that could be very helpful if something bad happened on your network. You have a pretty detailed log: this is when that bad actor got added, they waited, then made the setting change at this time that gave them additional privileges.

Micah Spady, Director of Product Marketing at SecureW2

Accounting supports troubleshooting, change tracking and compliance requirements by providing verifiable evidence of administrative actions.

Key Features of TACACS+

Key features of TACACS+ include:

1. Separate authentication, authorization and accounting (AAA) functions: Some administration protocols unite all AAA server functions, but TACACS+ separates them for more fine-tuned policy administration.
2. Centralized server authentication: TACACS+ verifies device credentials and access policies on a central server for consistent policy enforcement.
3. Command-level authorization: Administrators can define specific commands or actions that a user or group can perform on a device.
4. Complete session accounting: TACACS+ supports network security, troubleshooting and compliance with industry standards by maintaining detailed session logs with login and logout times, user ID, and time-stamped command inputs.
5. Enhanced security with full packet-body obfuscation: TACACS+ doesn’t just protect passwords; it obfuscates the full body of each packet. However, RFC 8907 warns that the mechanism does not provide any meaningful privacy, integrity, or replay protection. advanced security breaches can decrypt credentials into plaintext. That’s why RFC 9887 replaces TACACS+ with TLS 1.3.
6. Connection-based Transmission Control Protocol: TACACS+ uses TCP port 49 for reliable connection-based transmissions, as opposed to connectionless User Datagram Protocol (UDP).

Encryption in the TACACS+ Protocol

One of the most significant security improvements in TACACS+ is that it obfuscates each packet body.

Earlier authentication mechanisms often protected only the password field, leaving other parts of the communication visible to anyone monitoring network traffic. TACACS+ obfuscates the body of each packet exchanged between the network device and the authentication server. This protects sensitive management information: however, note that the packet header remains in cleartextUnlike older authentication methods that protected only passwords, TACACS+ obfuscates the full body of each packet. That includes the username, password, commands executed and authorization responses. However, the packet header remains in cleartext.

Obfuscating the packet body makes it more challenging for attackers to monitor administrative activity. However, TACACS+ is not encryption and does not guarantee privacy.

What is TCP Port 49?

TACACS+ uses TCP port 49 for communication between the network device and the authentication server. When an administrator attempts to access a router, switch or firewall, the device opens a connection to the TACACS+ server using this specific port to transmit the authentication request.

Using a standard TACACS+ port provides several advantages:

• Predictable firewall configuration
• Reliable communication over TCP
• Centralized monitoring of login attempts
• Dedicated authentication channel

Because the connection is established over TCP, communication is reliable and connection-oriented, ensuring that authentication data is delivered and processed correctly.

How TACACS+ Works

TACACS+ operates by placing a centralized decision point between administrators and the devices they manage.

When an administrator attempts to log in, the request goes to a network access server (NAS) such as a router or switch, and the device forwards the request to the TACACS+ server.

The server checks the provided credentials, evaluates authorization rules and returns an access decision. If approved, the administrator can access the management interface. If denied, the device blocks access. The session activity can also be recorded for auditing and compliance purposes.

This approach creates consistent access control across all infrastructure and ensures that permissions, verification and auditing are applied uniformly whenever an administrative session begins.

The TACACS+ authentication process follows a structured sequence:

1. An administrator connects to a network device.
2. The device prompts for login credentials.
3. The device sends the request to the TACACS+ server.
4. The server verifies the administrator’s identity.
5. The server checks authorization policies.
6. The device allows or denies access.
7. The server logs administrative activity.

This process ensures the network device does not independently decide access permissions. Instead, a central authority evaluates every login. This centralized model makes TACACS+ particularly well-suited for large-scale environments where consistent, auditable access control across many devices is essential.

TACACS+ vs. Other Device and Network Security Protocols

What’s the difference between TACACS+ and other common security protocols? We’ll distinguish between TACACS+, the original TACACS protocol, RADIUS protocol and local device authentication.

TACACS+ vs. TACACS

The original TACACS protocol was vastly different from modern TACACS+.

From encryption coverage to administrative control, TACACS+ offers more robust security; it’s almost entirely replaced TACACS.

The table below compares TACACS+ with the original TACACS.

Feature	TACACS+	TACACS
Packet Protection	Full packet body obfuscated	Password only
AAA Functions	3 separate processes	Combined
Transport Protocol	TCP (Port 49)	UDP / TCP
Command-Level Authorization	Supported	Not supported
Current Usage	Common standard for network device administration	Rarely used today

TACACS+ vs. RADIUS

Although Terminal Access Controller Access-Control System Plus (TACACS+) and Remote Authentication Dial-In User Service (RADIUS) are both centralized authentication protocols, they were designed to solve different security challenges.

TACACS+ focuses on protecting administrative control of network infrastructure, while RADIUS protocol is intended to verify users and devices attempting to access the network.

You may also hear the terms “TACACS+ servers” and “RADIUS servers.” These simply refer to any AAA server (on-premises or virtual) that’s configured for TACACS+ or RADIUS, respectively.

Comparing TACACS+ vs RADIUS helps organizations determine whether they need to secure management interfaces or regulate network connectivity across users, devices and remote connections.

The table below highlights the key differences between TACACS+ and RADIUS.

Feature	TACACS+	RADIUS
Primary Function	Device administration	Network access authentication
Transport Protocol	Transmission Control Protocol (TCP) Port 49	Typically, User Datagram Protocol (UDP), but can support TCP
Confidentiality	Packet body obfuscated (MD5-based); full TLS 1.3 encryption under RFC 9887	Password only
Authorization Granularity	Command level	Policy level
Typical Use	Routers and switches	Wi-Fi, VPN, network access

For a deeper comparison, see our TACACS+ vs. RADIUS article.

TACACS+ vs. Local Device Authentication

Before centralized authentication with TACACS+, devices stored local administrator accounts. Each router or switch maintained its own credentials. Centralization streamlines user management and improves security because administrators no longer manage credentials individually across the infrastructure.

TACACS offers multiple benefits when compared to local authentication.

The table below compares the two across several features.

Feature	TACACS+	Local Authentication
Credential Storage	Centralized	On each device
Access Revocation	Immediate everywhere	Manual per device
Logging	Centralized audit trail	Limited
Permission Control	Granular authorization	Minimal

Use Cases: When Do Organizations Use TACACS+?

TACACS+ is typically deployed in environments where multiple administrators manage critical network infrastructure and accountability is essential, such as:

• Enterprise data centers
• Campus networks
• Government networks
• Service providers
• Large IT operations

Organizations such as these rely on continuous operation and strict operational procedures to ensure only authorized personnel can access and modify network devices.

Centralized administrative authentication helps maintain control while providing visibility into who accessed a system and what actions were taken.

Using TACACS+ in these environments is particularly valuable for compliance because it records configuration changes and command execution.

Within these environments, specific use cases for TACACS+ include:

• Remote access: Authenticate and authorize remote administrators, such as administrators requesting access through a virtual private network (VPN).
• Network device management: Manage granular access control for network devices, particularly Cisco network equipment such as routers and switches.
• Server access: Validate access and authorize device-specific permissions for access to web servers, database servers and more.
• Security compliance: Meet regulatory requirements such as PCI DSS through controlled, recorded access logs.

How to Install TACACS+ On Your Network

To configure a TACACS server on your network, you will need:

• A server host
  • On-premises options include TACACS.net and Cisco Identity Services Engine (ISE)
  • Cloud-based options include Cisco Identity Services Engine (ISE)
• Detailed role-based access control policies

Here’s how to set up TACACS+ on your network:

1. Identify server host(s): Name and prioritize your IP hosts with specific commands for TACACS+ (not basic TACACS).
2. Select a TACACS server key: This process uses just one global key for authentication and encryption.
3. Configure AAA server groups: Designate specific hosts or host groups for specific purposes and use access control policies to assign users to appropriate server groups.
4. Specify TACACS+ for each function of AAA: Administrators can only access TACACS+ with AAA commands; you must configure TACACS+ as the specified server for each function.

The exact steps for TACACS+ configuration depend on your server host.

Some managed services, including the SecureW2 Cloud RADIUS platform, offer multiprotocol support for both TACACS+ and RADIUS authentication protocols.

As a managed provider, the Cloud RADIUS team can assist you with setup, avoiding complex implementation processes.

Benefits of TACACS+

In the right context, TACACS+ offers distinct benefits for network administrators. This device administration protocol is flexible, secure and audit-ready:

• Full packet-body encryption of client-server traffic, or full-session encryption via TLS 1.3 under RFC 9887
• Secure control of network devices
• Command authorization for granular control
• Distinct, flexible settings for AAA functions
• Compliant documentation for troubleshooting and audits
• Compatibility with other security measures, including multi-factor authentication

However, the limitations of TACACS+ can make it a poor choice for many modern use cases.

Limitations of TACACS+

While TACACS+ provides strong protection for administrative access to network devices, it was designed for a specific use case and does not address all modern access scenarios.

The protocol focuses on verifying administrators logging into infrastructure equipment rather than authenticating everyday users or endpoints connecting to services.

The following are some of TACACS+ limitations in modern environments:

• Focused only on administrative logins
• Limited support for end user and device identity
• Insufficient encryption may expose plaintext user credentials and data
• Single point of failure without local backup
• Historically Cisco-centric. Multi-vendor support is available, but can vary in availability
• Not designed for cloud workloads
• Not intended for wireless 1X authentication
• No mutual authentication

As organizations adopt cloud services and remote access, authentication must extend beyond infrastructure management.

TACACS+ Over TLS 1.3

TACACS+ has been the preferred protocol for managing administrator access to routers, switches, firewalls and other network infrastructure for many years.

While it provides centralized authentication, authorization and accounting (AAA), it has also carried a long-standing security limitation.

Warning: Traditional TACACS+ protects only the packet body using MD5-based obfuscation, while packet headers remain unencrypted. As cryptographic standards have evolved, this approach has become increasingly outdated, especially for organizations transmitting administrative traffic across shared or untrusted networks.

To address this, the IETF published RFC 9887: TACACS+ over TLS 1.3 in December 2025. The new standard secures the entire TACACS+ session by encapsulating it within a TLS 1.3 connection.

Instead of relying on MD5 obfuscation, every part of the communication, including packet headers and authentication exchanges, is protected using modern encryption.

RFC 9887 also requires TLS 1.3 as the minimum supported version, ensuring that TACACS+ benefits from forward secrecy and stronger cryptographic protections that are already standard across protocols such as HTTPS and secure API communications.

The TACACS+ YANG data model, referenced by RFC 9887, enables teams to manage TACACS+ client configuration through model-driven tooling, with RFC 9887 providing the necessary TLS parameters to that model.

For enterprise IT teams, this is a significant step forward. Administrative access to network infrastructure often provides among the highest levels of privilege within an organization. Protecting those authentication sessions with TLS 1.3 reduces the risk of credential interception and improves the confidentiality of management traffic as it moves across the network.

Note: The move to TACACS+ over TLS mirrors a broader trend across enterprise networking. Just as RadSec modernized RADIUS by replacing legacy transport security with TLS, RFC 9887 brings TACACS+ in line with current security expectations.

Organizations operating network infrastructure in regulated environments, or those aligning with frameworks such as NIST SP 800-53, PCI DSS, or CMMC, should consider adopting TACACS+ over TLS as part of their ongoing security modernization efforts.

TACACS+ provides a standards-based way to strengthen one of the most critical components of enterprise network administration while remaining compatible with modern automation and identity management workflows.

Modernizing Network Access Control: From TACACS+ to Identity-Based Security

TACACS+ is still used today and remains an important control for protecting administrative access to network infrastructure. It centralizes authentication, enforces administrator permissions, and records management activity for auditing and accountability.

Through TCP port 49, the TACACS+ protocol provides strong security for routers, switches, and other critical devices.However, modern environments extend far beyond device management.

Organizations now need to verify users, endpoints, and services across wired networks, wireless access and remote connections. As a result, authentication strategies must expand from protecting configuration interfaces to validating every connection attempt.

SecureW2 Cloud RADIUS centralizes authentication across wired networks, Wi-Fi, VPNs and remote access, while JoinNowDynamic PKI enables certificate-based identity verification and automated device onboarding.

Together, they verify user and device identities, automatically apply access policies, and record activity for auditing and compliance.

Instead of maintaining fragmented controls on individual systems, administrators gain a unified platform to control who connects, what they can access, and how activity is monitored.

Schedule a demo to learn how identity-based authentication can strengthen security and simplify operations across your entire environment.