Network Access Device Administration · Topic 1 of 2
AAA Protocols
Learn the three A functions of AAA and compare RADIUS and TACACS+, including ports, message types, encryption, attributes and when to use each with ISE.
- 5 min
- AAA means authentication, authorization and accounting.
- RADIUS uses UDP ports 1812 and 1813, with the older pair 1645 and 1646.
- TACACS+ uses TCP port 49.
What it is
AAA stands for authentication, authorization and accounting, the three questions a network asks about every user.
Authentication asks who you are, authorization asks what you may do, and accounting records what you did.
Two protocols carry these questions to a server such as ISE: RADIUS and TACACS+.
How it works
Each protocol runs the three functions in its own way, and each suits a different job.
The three functions
| Function | Question | Example |
|---|---|---|
| Authentication | Who are you? | A password or a certificate is checked |
| Authorization | What may you do? | A VLAN is set, or a command is allowed |
| Accounting | What did you do? | Session start, stop and commands are logged |
RADIUS
RADIUS is an open standard, and it is the protocol for network access. It is used by 802.1X, MAB, web authentication and VPN logins.
It runs over UDP. Authentication and authorization use port 1812, and accounting uses port 1813. Older systems use ports 1645 and 1646.
RADIUS combines authentication and authorization in one exchange. The server sends back the result and the authorization attributes together, in the same reply.
Only the password in a request is hidden. The rest of the packet is sent in the clear, and a shared secret protects the exchange.
RADIUS messages
| Message | Direction | Purpose |
|---|---|---|
| Access-Request | Device to server | Asks to authenticate a user |
| Access-Accept | Server to device | Allows the user, with attributes |
| Access-Reject | Server to device | Denies the user |
| Access-Challenge | Server to device | Asks for more data, as in EAP |
| Accounting-Request | Device to server | Reports session start, update or stop |
| Accounting-Response | Server to device | Confirms the accounting record |
RADIUS attributes
An attribute is a field of data in a message. The user name, the NAS address and the calling station ID are standard attributes.
Vendors can add their own with the vendor specific attribute. Cisco devices use the Cisco AV pair for items such as a downloadable ACL name or a redirect URL. This is how ISE returns policy to the device.
CoA
RADIUS also has dynamic authorization, which lets the server send a message to the device after the session began. This is the CoA that earlier pages used.
TACACS+
TACACS+ was developed by Cisco, and it is the protocol for device administration. It is used when an administrator logs in to a router, switch or firewall.
It runs over TCP on port 49. TCP gives it a reliable connection, so it does not need the retry logic that RADIUS has.
TACACS+ separates the three functions. The device can ask for authentication, then authorization, then accounting, as separate exchanges. This gives control over each command.
The whole body of a TACACS+ packet is encrypted, not just the password. A shared secret is used here as well.
TACACS+ packet types
Authentication uses start, reply and continue packets. Authorization uses a request and a response. Accounting uses a request and a reply.
Comparing the two
| Feature | RADIUS | TACACS+ |
|---|---|---|
| Transport | UDP | TCP |
| Ports | 1812 and 1813 | 49 |
| AAA functions | Authentication and authorization combined | All three separate |
| Encryption | Password only | Whole packet body |
| Standard | Open standard | Cisco developed |
| Typical use | Network access | Device administration |
| Command control | Limited | Per command authorization |
Choosing a protocol
Use RADIUS for users and devices that connect to the network. Use TACACS+ for administrators who log in to network devices.
Many networks use both on the same ISE deployment. ISE runs RADIUS for network access, and TACACS+ for administration, on the Policy Service Nodes.
Where the protocols meet ISE
On the network device you point the AAA settings at ISE. For RADIUS, the server is defined with its ports and key, and for TACACS+ with its address and key.
The device uses the same shared secret as the ISE network device entry.
Switch(config)# radius server ISE-PSN1
Switch(config-radius-server)# address ipv4 10.1.1.11 auth-port 1812 acct-port 1813
Switch(config-radius-server)# key SECRET
Switch(config-radius-server)# exit
Switch(config)# tacacs server ISE-TAC1
Switch(config-server-tacacs)# address ipv4 10.1.1.11
Switch(config-server-tacacs)# key SECRETTo tell which protocol a scenario needs, ask who is logging in. A user joining the network points to RADIUS, and an administrator typing commands points to TACACS+.
What to remember for the exam
Eight facts cover this topic.
- AAA means authentication, authorization and accounting.
- RADIUS uses UDP ports 1812 and 1813, with the older pair 1645 and 1646.
- TACACS+ uses TCP port 49.
- RADIUS combines authentication and authorization. TACACS+ separates all three.
- RADIUS hides only the password. TACACS+ encrypts the whole packet body.
- RADIUS is an open standard. TACACS+ was developed by Cisco.
- RADIUS suits network access, and TACACS+ suits device administration.
- Access-Request, Access-Accept, Access-Reject and Access-Challenge are the main RADIUS messages.
A shared secret mismatch breaks both protocols. The device and the ISE network device entry must hold the same key.
Common mistakes
These four mistakes are common.
Mixing the ports. RADIUS is UDP and TACACS+ is TCP.
Using RADIUS for command control. It has limited command authorization.
Saying TACACS+ encrypts only the password. That describes RADIUS.
Forgetting the old RADIUS ports. Some devices still use 1645 and 1646.
Check yourself
Work through these three questions.
Which transport and port does TACACS+ use?
TCP port 49.
What is the main difference in what RADIUS and TACACS+ encrypt?
RADIUS hides only the password, and TACACS+ encrypts the whole packet body.
Which protocol would you use for administrators logging in to switches?
TACACS+, because it separates authorization and can control each command.
Topic 1 of 2 in Network Access Device Administration
Test yourself on Network Access Device Administration
The full Cisco CCNP 300-715 SISE question bank has 852 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.