TACACS+ is a Cisco-based AAA protocol that centralizes authentication, authorization and accounting for administrative access to network devices – with full payload encryption.

Facts (ENCOR 350-401)

• Function: central AAA for device administration · Standard: Cisco proprietary
• TCP port 49 (stateful, more reliable than RADIUS UDP)
• Encryption: entire payload (not just the password like RADIUS)
• Requires aaa new-model and reachability to the server

Why does it exist?

Without it: local users on every device, no central control, no unified logging, hard to enforce uniform security policy, poor compliance/auditing. Typical scenarios: enterprises with many devices, role-based access, audit requirements (“who changed what?”), integration with ISE/AD.

How it works

TACACS+ separates AAA into three independent processes: Authentication (who are you?), Authorization (what may you do?), Accounting (what did you do?).

1. Admin logs in via SSH
2. Router sends login info to the TACACS+ server (TCP 49)
3. Server returns privilege level, command restrictions, shell profiles
4. Accounting logs all commands centrally
5. On server failure: fallback to the local database (if configured)

Term	Explanation
Method list	Defines the order of AAA methods
Privilege level	Cisco CLI permission level (0–15)
Command authorization	Control of individual commands
Fallback	Local login if the server is down

Configuration

Basic (CCNA/ENCOR):

aaa new-model
tacacs server TAC1
 address ipv4 10.1.1.10
 key Cisco123
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local
aaa accounting exec default start-stop group tacacs+
line vty 0 4
 login authentication default
 transport input ssh

Advanced (CCNP):

aaa authorization commands 15 default group tacacs+ local
aaa accounting commands 15 default start-stop group tacacs+

Verification & troubleshooting

show aaa servers
show tacacs
debug aaa authentication
debug tacacs
debug aaa authorization

Symptom	Cause	Solution
Login fails	Server unreachable	Check routing
Timeout	Wrong key	Match the shared secret
No privilege 15	Missing authorization	Check method list
Login works locally	TACACS down	Verify server status

Design & best practices

• Always configure local fallback · use SSH, not telnet · command authorization in enterprise · redundant TACACS+ servers · send accounting to SIEM

Exam tips ⚠️

• Device administration → TACACS+
• Command authorization → TACACS+ (not RADIUS)
• Full encryption → TACACS+
• 802.1X / user network access → RADIUS

Quick summary

• TCP 49 · full payload encryption · separate AAA functions · best for device admin · supports command authorization