RADIUS vs TACACS+: Cisco AAA Configuration Guide

AAA — Authentication, Authorization and Accounting — is what turns device logins from a shared password into per-engineer accountability. Two protocols dominate: RADIUS, the open standard for network access (Wi-Fi, 802.1X, VPN), and TACACS+, the Cisco-designed protocol for device administration with full per-command authorization. This guide compares them, configures both on a Cisco IOS router, and covers the fallback pattern that keeps you from locking yourself out.

RADIUS vs TACACS+

              RADIUS                        TACACS+
Standard      Open (RFC 2865)               Cisco-proprietary
Transport     UDP 1812 auth / 1813 acct    TCP 49
Encryption    password only                entire packet
AAA split     auth + authz combined        three separate exchanges
Per-command   limited                      full command-by-command
Use case      Wi-Fi, 802.1X, VPN users     device admin (router/switch login)

RADIUS encrypts only the password and cannot cleanly authorize individual commands; TACACS+ encrypts the whole payload and can approve or deny every command an engineer types. That is why large networks run both: TACACS+ for the operations team, RADIUS for end users.

Configuring AAA on Cisco IOS

Modern IOS uses named server blocks; the shared key must match the server exactly:

radius server RAD1
 address ipv4 10.10.10.10 auth-port 1812 acct-port 1813
 key RadSecret123
 exit
tacacs server TAC1
 address ipv4 10.10.10.20
 key TacSecret123
 exit

Enable the AAA framework and build method lists — each list is read left to right, and local at the end is the safety net that only kicks in when the server is unreachable (not when it rejects the password):

aaa new-model
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local
aaa authorization commands 1 default group tacacs+ local
aaa authorization commands 15 default group tacacs+ local
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
username admin privilege 15 secret RescuePass123

The authorization commands lines are what give TACACS+ its power: a NOC operator in a restricted shell can be denied configure per command, while the admin passes everything. Accounting records who logged in and what they typed.

Applying AAA to Lines and VTYs

line con 0
 login authentication default
line vty 0 4
 login authentication default
 transport input ssh

aaa new-model applies local authentication to all lines immediately — so create the fallback user before enabling AAA, or an unreachable TACACS+ server locks everyone out including yourself.

Verification

show running-config | include aaa
show aaa servers
show users
debug aaa authentication

Confirm the method lists, the server reachability and the active sessions. For the endpoint side of network access control see DHCP snooping trusted/untrusted ports, and for remote management transport check SSH/STelnet configuration on Huawei switches — the same AAA patterns apply across vendors.

原文链接：https://computingforgeeks.com/aaa-radius-tacacs-explained