4.1e — AAA, RADIUS, TACACS+, EAP Variants (14)

AAA server

Centralized authentication server; RADIUS, LDAP, or TACACS are common implementations.

AAA framework

Identification, then Authentication (who are you), Authorization (what can you access), and Accounting (logged usage metrics).

RADIUS

Remote Authentication Dial-In User Service; widely supported centralized authentication protocol used for network device logins, VPN, and 802.1X.

RADIUS characteristics

Primarily used for network access; combines authentication and authorization into one step; encrypts only the password in the access-request packet, not the full payload.

TACACS+

AAA protocol that separates authentication and authorization into distinct steps, encrypts the entire payload, and is used primarily for device administration rather than general network access.

RADIUS vs TACACS+

RADIUS: network access, combines authN/authZ, encrypts only the password. TACACS+: device administration, separates authN/authZ, encrypts the full payload.

802.1D

Spanning Tree Protocol, prevents switching loops. Unrelated to authentication; a common exam trap alongside 802.1X.

EAP (reinforced)

Framework embedding the authentication conversation within 802.1X; vendor-customizable.

EAP-TLS (reinforced)

Certificate-based, mutual authentication EAP variant; the strongest option.

LEAP

Cisco's deprecated, proprietary EAP variant; vulnerable to offline dictionary attacks.

PEAP (Protected EAP)

EAP tunneled inside TLS for protection; common in enterprise Wi-Fi deployments.

EAP-TTLS

Similar TLS-tunneling concept to PEAP, less commonly deployed.

Supplicant / authenticator / authentication server (Wi-Fi)

The same three 802.1X roles from wired networks, applied to the Wi-Fi login flow: device requesting access, device enforcing the block, and the server making the decision.

Bluetooth PIN pairing

The actual security mechanism for classic Bluetooth pairing, not MFA.