RADIUS or TACACS+: what is the difference, and when do you use each?
Show the answer
Say this first
RADIUS runs over UDP 1812 for authentication and 1813 for accounting (older devices use 1645 and 1646), combines authentication and authorization in one reply, and hides only the password attribute. TACACS+ runs over TCP 49, encrypts the whole packet body, and keeps authentication, authorization and accounting as separate exchanges, which is what makes per-command authorization possible. I use RADIUS for network access (802.1X, MAB, VPN, Wi-Fi) and TACACS+ for engineers logging in to network devices.
Go deeper
Side by side
| RADIUS | TACACS+ | |
|---|---|---|
| Transport | UDP 1812 auth, 1813 accounting | TCP 49 |
| What is protected | only the User-Password attribute | the whole body (header in clear) |
| AAA structure | authentication and authorization in one Access-Accept | three separate exchanges |
| Per-command authorization | no | yes |
| Standard | IETF, RFC 2865 and RFC 2866 | Cisco origin, documented in RFC 8907 |
| Extensions | vendor-specific attributes (attribute 26) | attribute-value pairs |
| Typical use | network access: 802.1X, MAB, VPN, wireless | device administration |
RADIUS message flow
Access-Request, then any number of Access-Challenge and Access-Request rounds (EAP runs here), then Access-Accept or Access-Reject. The Accept can carry policy: a VLAN, a downloadable ACL, a session timeout, a security group tag. Accounting-Request start, interim and stop records go to port 1813.
Why TACACS+ for administrators
Each command can be authorized and logged on its own, and the command text is encrypted on the wire. TCP also tells the device at once when a server is down, instead of waiting for UDP timeouts and retries.
They will ask next
How weak is RADIUS's protection?
Usernames and all other attributes travel in clear, and the password hiding is based on MD5 and the shared secret. The 2024 BlastRADIUS research showed an on-path attacker could forge an Access-Accept when the Message-Authenticator attribute is not required. Fixes: require Message-Authenticator on every packet, patch clients and servers, and carry RADIUS inside TLS (RadSec, TCP 2083) or IPsec across untrusted networks.
Can RADIUS be used for device administration?
Yes, and many vendors do it: the Access-Accept carries the privilege level, for example the Cisco AV pair
shell:priv-lvl=15. What you lose is per-command authorization.
Traps
- Saying TACACS+ is Cisco only. Juniper, Arista, Palo Alto and Fortinet all support it.
- Swapping which protocol encrypts what. RADIUS hides the password, TACACS+ encrypts the body.