RADIUS TACACS+

RADIUS

Remote Authentication Dial-In User Service; an open-standard AAA protocol commonly used for network access (Wi-Fi, VPN, 802.1X) [user access].

TACACS+

Terminal Access Controller Access-Control System Plus; a Cisco proprietary AAA protocol used for controlling administrative access to network devices [routers switches].

RADIUS Protocol

Uses UDP (ports 1812 for authentication/authorization, 1813 for accounting); faster but less reliable.

TACACS+ Protocol

Uses TCP (port 49); more reliable connection for administrative control.

RADIUS Encryption

Encrypts only the user password in transmission; other data is sent in plaintext.

TACACS+ Encryption

Encrypts the entire packet including username, password, and authorization data.

RADIUS AAA Function

Combines authentication and authorization in a single step.

TACACS+ AAA Function

Separates authentication, authorization, and accounting for better control.

RADIUS Use Case

Best suited for user access control, such as remote VPNs or enterprise wireless logins.

TACACS+ Use Case

Best suited for administrative access to routers, switches, and firewalls.

RADIUS Vendor Support

Open standard supported by many vendors (Cisco, Juniper, Aruba, etc.).

TACACS+ Vendor Support

Cisco proprietary protocol supported mainly on Cisco devices.

RADIUS Performance

Lightweight and fast, good for high user volume environments.

TACACS+ Control

Fine-grained command-level control over device access.