TACACS+ — Encrypted, Separated AAA for Device Admin

Cisco’s device-administration AAA protocol: TCP 49, entire payload encrypted, and the three A’s are separate decisions — you can authenticate via TACACS+ while authorising commands elsewhere. That command-level authorization is why ENCOR prefers it for CLI access. aaa new-model tacacs server TAC1 address ipv4 10.10.10.20 key cisco123 aaa authentication login default group tacacs+ local aaa […]

RADIUS — UDP AAA for Access & Accounting

Centralised AAA over UDP: authentication 1812, accounting 1813 (legacy 1645/1646). Only the password field is encrypted — headers and attributes travel in the clear, which is the core difference to TACACS+. Flow: Access-Request → Access-Accept/Reject/Challenge; authorization returns attributes (VLAN, ACL, session timeout); accounting sends start/stop/interim updates. The protocol of 802.1X and wireless (ISE downstream) — […]

Local AAA — Users, Method Lists & Lockout Traps

AAA = who are you (Authentication), what may you do (Authorization), what did you do (Accounting) — all three served locally from the router’s own user database when no AAA server exists. username admin privilege 15 secret Str0ngP@ss ip domain-name example.com crypto key generate rsa modulus 2048 line vty 0 4 transport input ssh login […]