RADIUS vs TACACS+
Both RADIUS and TACACS+ carry AAA, but differ: RADIUS is an open standard over UDP that encrypts only the password; TACACS+ is Cisco-developed over TCP that encrypts the entire payload and separates the three A's. Rule of thumb: RADIUS for network access, TACACS+ for device administration.
Side by side
| RADIUS | TACACS+ | |
|---|---|---|
| Standard | Open (IETF) | Cisco-developed |
| Transport | UDP | TCP |
| Encryption | Password only | Entire payload |
| AAA separation | Combines authN + authZ | Separates all three |
| Best for | Network access (802.1X, Wi-Fi) | Device administration |
When to use which
RADIUS shines for network access — 802.1X, Wi-Fi and VPN authentication, where it is the universal standard. TACACS+ shines for device administration — controlling exactly which CLI commands each admin can run, because it separates authorization and can authorise per-command.
The security difference that matters
RADIUS encrypts only the password field, leaving usernames and attributes in clear text. TACACS+ encrypts the whole packet body. Combined with per-command authorization, that is why enterprises favour TACACS+ for managing network gear.
Frequently asked questions
What is the difference between RADIUS and TACACS+?
RADIUS is an open standard over UDP that encrypts only the password and combines authentication with authorization. TACACS+ is Cisco-developed over TCP, encrypts the whole payload, and separates all three AAA functions.
When should I use RADIUS vs TACACS+?
Use RADIUS for network access such as 802.1X, Wi-Fi and VPN. Use TACACS+ for device administration, where per-command authorization and full payload encryption matter.
Is TACACS+ more secure than RADIUS?
For device administration, yes — it encrypts the entire packet rather than just the password, and separates authentication from authorization for finer control.
What transport protocols do they use?
RADIUS uses UDP; TACACS+ uses TCP, which gives it more reliable delivery and connection awareness.
Related articles
Want hands-on training?
Learn this on real Cisco lab devices with placement support at Attila Technologies, Ahmedabad.