RADIUS vs TACACS+: Cisco AAA Configuration Guide

AAA — Authentication, Authorization and Accounting — is what turns device logins from a shared password into per-engineer accountability. Two protocols dominate: RADIUS, the open standard for network access (Wi-Fi, 802.1X, VPN), and TACACS+, the Cisco-designed protocol for device administration with full per-command authorization. This guide compares them, configures both on a Cisco IOS router, and covers the fallback pattern that keeps you from locking yourself out.

RADIUS vs TACACS+

              RADIUS                        TACACS+
Standard      Open (RFC 2865)               Cisco-proprietary
Transport     UDP 1812 auth / 1813 acct    TCP 49
Encryption    password only                entire packet
AAA split     auth + authz combined        three separate exchanges
Per-command   limited                      full command-by-command
Use case      Wi-Fi, 802.1X, VPN users     device admin (router/switch login)

RADIUS encrypts only the password and cannot cleanly authorize individual commands; TACACS+ encrypts the whole payload and can approve or deny every command an engineer types. That is why large networks run both: TACACS+ for the operations team, RADIUS for end users.

Configuring AAA on Cisco IOS

Modern IOS uses named server blocks; the shared key must match the server exactly:

radius server RAD1
 address ipv4 10.10.10.10 auth-port 1812 acct-port 1813
 key RadSecret123
 exit
tacacs server TAC1
 address ipv4 10.10.10.20
 key TacSecret123
 exit

Enable the AAA framework and build method lists — each list is read left to right, and local at the end is the safety net that only kicks in when the server is unreachable (not when it rejects the password):

aaa new-model
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local
aaa authorization commands 1 default group tacacs+ local
aaa authorization commands 15 default group tacacs+ local
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
username admin privilege 15 secret RescuePass123

The authorization commands lines are what give TACACS+ its power: a NOC operator in a restricted shell can be denied configure per command, while the admin passes everything. Accounting records who logged in and what they typed.

Applying AAA to Lines and VTYs

line con 0
 login authentication default
line vty 0 4
 login authentication default
 transport input ssh

aaa new-model applies local authentication to all lines immediately — so create the fallback user before enabling AAA, or an unreachable TACACS+ server locks everyone out including yourself.

Verification

show running-config | include aaa
show aaa servers
show users
debug aaa authentication

Confirm the method lists, the server reachability and the active sessions. For the endpoint side of network access control see DHCP snooping trusted/untrusted ports, and for remote management transport check SSH/STelnet configuration on Huawei switches — the same AAA patterns apply across vendors.

How AAA Method Lists Actually Decide

An aaa command is not a single check — it is an ordered list of methods, and the device stops at the first one that produces a definitive answer. Understanding the three possible outcomes is what separates a working AAA rollout from a lockout:

• Pass — the method accepts the credentials and the list stops. Later methods never run.
• Fail — the method actively rejects the credentials (wrong password, unknown user). The list stops here too, and local is not consulted.
• Error — the method cannot answer at all: no response, a transport timeout, or a server already flagged as dead. Only in this case does the router try the next method.

That third case is the entire reason local sits at the end of a production method list. It is not a second password database — it is a survival hatch for the day the AAA server is unreachable. Because a Fail halts the list, a user the TACACS+ server explicitly rejects cannot fall back to a local account, which is exactly the behaviour auditors expect.

aaa authentication login default group tacacs+ group radius local
aaa authentication login CONSOLE local
aaa authorization exec default group tacacs+ local
aaa authorization commands 15 default group tacacs+ local

Read left to right: the default list tries TACACS+ first, RADIUS second, and the local database last. The named CONSOLE list never touches a remote server at all, so an engineer with physical access can always recover a device even when the whole path to the AAA server is down.

Building RADIUS Server Groups on Cisco IOS

RADIUS servers are declared once and then referenced by name, which keeps method lists short and lets you swap an address in a single place. Group two or more servers into a named group so a dead primary is skipped automatically:

radius server RAD1
 address ipv4 10.10.10.10 auth-port 1812 acct-port 1813
 key RadSecret123
exit
radius server RAD2
 address ipv4 10.10.10.11 auth-port 1812 acct-port 1813
 key RadSecret123
exit
aaa group server radius RAD-GROUP
 server name RAD1
 server name RAD2
exit
aaa authentication login default group RAD-GROUP local
aaa accounting network default start-stop group RAD-GROUP

The legacy global form radius-server host 10.10.10.10 key RadSecret123 still works and you will see it in older configs, but named server blocks are the supported style on IOS 15.x and IOS XE. Note the ports: modern RADIUS uses 1812/1813 (RFC 2865/2866). The older 1645/1646 pair still appears on legacy servers and on some ISE deployments, and a mismatch is a silent authentication failure rather than a configuration error.

What TACACS+ Buys You: Per-Command Authorization

RADIUS authorizes a role; TACACS+ authorizes every command. That is the practical difference in operations. With command authorization enabled, the router sends each command to the TACACS+ server, which answers permit or deny before the command runs — so a NOC operator can be allowed show and denied configure without you maintaining a dozen local privilege levels.

tacacs server TAC1
 address ipv4 10.10.10.20
 key TacSecret123
 timeout 5
exit
aaa new-model
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local
aaa authorization commands 1 default group tacacs+ local
aaa authorization commands 15 default group tacacs+ local
aaa accounting commands 15 default start-stop group tacacs+

The server side expresses this as a command set. In tac_plus.conf the same policy looks like this:

# tac_plus.conf - attach to the user or group definition
user noc {
    default service = permit
    service = exec {
        priv-lvl = 1
    }
    cmd = show     { permit .* }
    cmd = ping     { permit .* }
    cmd = configure { deny .* }
}

Two operational notes. First, command authorization must cover both privilege 1 and privilege 15 or an operator who lands in enable mode silently bypasses the restriction. Second, when the TACACS+ server is unreachable and local is in the authorization list, the user is authorized only at the privilege level carried by the local username statement — not at the richer level the TACACS+ server would have granted. That is usually acceptable, but it is worth documenting so it is not mistaken for a bug.

Accounting: Who Logged In and What They Typed

Accounting is the part that pays for itself during an outage or an audit. IOS supports two families of records, and they answer different questions:

• exec accounting (aaa accounting exec default start-stop group tacacs+) records login and logout with a timestamp, the source IP address and a session ID — the raw material for "who was on the device at 02:14 when the route disappeared".
• commands accounting (aaa accounting commands 15 default start-stop group tacacs+) records each command entered at a given privilege level — the audit trail that shows what was actually typed, not just that someone was logged in.

The start-stop keyword sends a record at the beginning and the end of the session. stop-only logs only the end, which halves the traffic but loses the start timestamp; wait-start delays the session until the server acknowledges the start record, which is the strictest and also the most fragile option. For device administration, start-stop is the normal choice.

One caveat worth repeating: command accounting (and command authorization) require TACACS+. RADIUS has no equivalent mechanism for per-command records, which is why the two protocols coexist in mature networks.

Hardening the Login Path

AAA decides who gets in; the line configuration decides how. A minimal hardened baseline for a router or switch:

ip domain-name example.net
crypto key generate rsa modulus 2048
ip ssh version 2
username admin privilege 15 secret %StrongFallback%
line vty 0 15
 login authentication default
 transport input ssh
 exec-timeout 10 0
line con 0
 login authentication CONSOLE
 exec-timeout 5 0
banner login ^C Unauthorized access is prohibited. Activity is monitored.^C
service password-encryption

Three details matter more than they look. Use secret rather than password — password stores a reversible type-7 string that anyone with the config can decode, while secret stores an MD5 or scrypt hash. Point VTYs at the AAA list but keep the console on a local-only named list, so the out-of-band path never depends on the network. And set an exec-timeout on every line; an idle privileged session on a console server is an open door.

If the AAA server lives on a management VLAN, pin the source address so requests never leave through a routed interface that the server does not expect:

ip radius source-interface Loopback0
ip tacacs source-interface Loopback0

Troubleshooting AAA: The Failures You Will Actually Hit

1. Key mismatch. The shared key must match byte for byte. Trailing whitespace, mixed case and a copied smart quote are the usual culprits. The symptom is a clean authentication Fail with nothing useful in the server log.
2. Wrong source interface or an ACL in the path. The request arrives from an address the server is not configured to accept, or a management ACL drops UDP 1812 or TCP 49. Fix with the source-interface commands above and confirm reachability with a test.
3. Wrong port. 1645/1646 against a server listening on 1812/1813 (or the reverse) looks like silence, not like an error.
4. Dead-server timeout. After a few unanswered requests IOS marks the server dead for the configured deadtime and the method list falls through to the next method. Engineers then "log in normally" against a server that is quietly offline — verify with show aaa servers.
5. Privilege mismatch. The TACACS+ server returns priv-lvl 1 but you never configured authorization commands 15, so the user reaches enable mode with no command control at all.

Test the credential path before you touch a production line:

test aaa group RAD-GROUP engineer1 Passw0rd new-code
test aaa group tacacs+ engineer1 Passw0rd legacy
show aaa servers
show tacacs
show users
debug aaa authentication
debug tacacs

test aaa exercises the real server path without logging anyone in — run it before every change window. Remember to turn the debugs off again; debug aaa authentication on a busy VTY is noisy enough to matter.

Multi-Vendor Notes: The Same Patterns, Different Spelling

The model — named server declarations, ordered method lists with a local escape hatch, separate authorization and accounting — is vendor-neutral, and the same design maps onto Arista EOS, Junos and Huawei VRP. If you operate a mixed fleet, compare the Arista EOS equivalent in Arista EOS AAA: TACACS+ and RADIUS configuration. For the endpoint side of network access control, where RADIUS is the star, see Cisco 802.1X and MAB configuration; for devices that authenticate on the wire but are managed over SSH, SSH/STelnet configuration on Huawei switches covers the transport assumptions. If you want a second protocol for monitoring device health, SNMPv3 authPriv on Cisco IOS and Junos uses the same shared-secret discipline as a AAA key.

Frequently Asked Questions

Can I run RADIUS and TACACS+ at the same time on one router? Yes, and most large networks do. Put both in the method list, TACACS+ first — for device administration it does the job with per-command granularity, while RADIUS still backs the 802.1X and VPN authentications on the same box.

Why did my login still work after I shut the AAA server down? Because the request timed out rather than failed, and the method list fell through to local. That is the designed behaviour, not a misconfiguration — but it also means "AAA is working" cannot be proven by logging in successfully. Use show aaa servers and the server's own logs.

Do I need both authorization exec and authorization commands? They control different things. exec decides the privilege level a user lands at after login; commands decides which commands are permitted at each level. Setting only the first gives you per-user roles but no enforcement once the user is in.

Which protocol should carry accounting? TACACS+ for administrative sessions, because it records the individual commands. RADIUS accounting is designed for network access sessions and will not give you a command trail.

原文链接：https://computingforgeeks.com/aaa-radius-tacacs-explained