AAA: RADIUS and TACACS+

A real-life situation

The company now has 40 switches and routers and eight network engineers. With local usernames, every new engineer means logging in to 40 devices to add an account, and when someone leaves, 40 more changes. Last month one device was missed and a former contractor could still log in. The fix is to keep the user list in one central server and have every device ask it. That is what AAA does.

What AAA is

AAA is a framework with three separate jobs:

The device asking the questions (SW1 here) is often called the network access device or AAA client. The server that answers is the AAA server; Cisco's product for this is Cisco ISE (Identity Services Engine). The two talk with one of two protocols: RADIUS or TACACS+.

RADIUS vs. TACACS+

A simple way to remember it: RADIUS lets users onto the network, TACACS+ controls admins on the devices.

Why it works that way

• One list, many devices. Adding or removing a person happens once, on the server, and takes effect everywhere.
• Separate jobs give finer control. Because TACACS+ asks separately for each command, the server can allow show commands for the help desk and everything for senior engineers, and log each command in accounting.
• A shared key protects the conversation. The device and the server share a secret key. It is used to hide the password (RADIUS) or the whole body (TACACS+) and to prove that replies really come from the server.
• Method lists avoid lock-out. If the server is down, nobody could log in to fix the network. A method list is an ordered list of ways to authenticate, such as "try the server group, then the local users".

How it works step by step

A method list with local fallback

A TACACS+ login

RADIUS and 802.1X: users onto the network

RADIUS is also what makes 802.1X work. 802.1X is port-based access control: a switch port (or Wi-Fi network) lets no traffic through until the device connected to it has logged in. It is a much stronger check than Port security, because it verifies a username or certificate rather than a MAC address that can be copied. There are three roles:

The same three roles appear in WPA2/WPA3-Enterprise Wi-Fi, where the wireless controller is the authenticator. See Wireless security.

How to configure it on Cisco IOS

⚠️ Based on Cisco IOS XE documentation, not run on a lab device. Create a local fallback user before typing aaa new-model: from that moment the lines use AAA instead of their line passwords, and the open session is the only safe way back in.

TACACS+ for device administration

RADIUS instead

Full example for SW1

How to verify it

SW1#test aaa group TAC-SERVERS alice Al1ce-Pass! legacy
Attempting authentication test to server-group TAC-SERVERS using tacacs+
User was successfully authenticated.

SW1#show tacacs
Tacacs+ Server -  public  :
               Server name: TAC1
            Server address: 192.168.20.50
               Server port: 49
              Socket opens:         14
             Socket closes:         14
              Socket aborts:          0
              Socket errors:          0
           Socket Timeouts:          0
   Failed Connect Attempts:          0
        Total Packets Sent:         42
        Total Packets Recv:         42
...

SW1#show running-config | include aaa
aaa new-model
aaa group server tacacs+ TAC-SERVERS
aaa authentication login default group TAC-SERVERS local
aaa authorization exec default group TAC-SERVERS local
aaa accounting exec default start-stop group TAC-SERVERS
...

debug aaa authentication shows each step of a login, including which method was tried and its result. Use it carefully on a busy device.

What goes wrong and how to troubleshoot it

Common mistakes

• Typing aaa new-model before any local user exists.
• Putting local first in the list, so the server is only used if the local database has no users at all.
• Expecting a server reject to fall back to local. Fallback is only for no answer.
• Mixing up the protocols: RADIUS is UDP and hides only the password; TACACS+ is TCP 49 and encrypts everything.
• Creating a named method list and forgetting login authentication <name> on the lines, so the default list is used instead.

💡 Exam tip: the CCNA asks you to tell the three As apart from a description ("records the commands a user ran" is accounting) and to compare RADIUS and TACACS+: UDP vs. TCP 49, password-only vs. full-body encryption, combined vs. separate AAA, network access vs. device administration. Know the 802.1X roles: supplicant, authenticator, authentication server. And remember that local fallback happens only when the server does not respond.

Key takeaways

• Authentication = who you are; authorization = what you may do; accounting = what you did.
• A central AAA server means one user list for every device.
• RADIUS: UDP, open standard, password-only encryption, used for network access and 802.1X.
• TACACS+: TCP 49, full encryption, separate AAA and per-command control, used for device admin.
• Method lists such as group TAC-SERVERS local fall back to local only when no server answers.

Check yourself