AAA and RADIUS vs TACACS+

AAA and RADIUS vs TACACS+ or TACACS PLUS
I
In this video we are going to learn about AAA, RADIUS & TACACS+

The AAA Model
=============

The AAA is a system, not a protocol. The AAA system was designed to authenticate users, authorize them & to see what they did on the network or device when given access.

As AAA stands for Authentication, Authorization & Accounting, lets look at each one.

AAA Authentication: This is the phase that governs what you are allowed to do once you are inside the network or an administrative device

AAA Authorization: This phase comes into play after authentication, basically this phase dictates WHAT you are allowed to do in the network based on your identity.

AAA Accounting: This phase occurs after authentication and authorization have been completed. Accounting allows administrators of the network to collect information about users & essentially what they did when they were given access to the network or to the administrative device..

AAA Protocols

Now there are three types of protocols that can enforce the AAA system, namely RADIUS, TACACS+ & Diameter.

Diameter, that is because it’s commonly used in the Mobile world & with Mobile service Providers.

Diameter is essentially a better version of RADIUS & is meant to replace it. but in this video we will be focusing on RADIUS & TACACS+ as they are the one’s commonly used in Data Networks.

How can RADIUS or TACACS+ run?
Now these protocols require a separate dedicated or a Virtual Server that provide the RADIUS or TACACS+ functionality & often both services like in the Cisco’s ISE.

RADIUS vs TACACS+ Point#1
========================
Radius uses the UDP protocol with the port numbers 1812 & 1813 respectively. Port 1812 is used for both Authentication & Authorization, so it kind a combines the two. On the other hand, port 1813 is used for accounting alone.

As for TACACS+, it uses TCP & uses the TCP port 49 for all of it’s communications. But unlike Radius, it separates all the AAA functions effectively, that means you have more granular control here especially when it comes to authorization. But Radius has the flexibility to authenticate a user in a wide variety of ways as it supports different authentication protocols like EAP, PAP & CHAP.

Question#1
==========
I am Confused with the Radius Port Numbers 1812 & 1813, aren't they 1645 & 1646 or all of them?

When the Radius protocol was first launched, it was indeed allotted UDP port 1645 for Authentication & Authorization & 1646 for Accounting. But according to the following RFC 2865 by Carl,Allan,welliam & Steve in the year 2000 for RADIUS, stating that:

“ The early deployment of RADIUS was done using UDP port number 1645, which conflicts with the "datametrics" service. The officially assigned port number for RADIUS is 1812."

In the other RFC numbered 2866 for RADIUS Accounting, the same is said for the accounting port as it contradicts with the "sa-msg-port"

“The early deployment of RADIUS Accounting was done using UDP port number 1646,which conflicts with the "sa-msg-port" service. The officially assigned port number for RADIUS Accounting is 1813.

Now although the RFC’s state that the port Numbers are no longer in use for radius, the confusion mainly arises because Cisco devices still default to the old ports 1645 & 1646

Cisco AAA servers like Cisco ISE listen’s to both these pairs of ports. If you ask Cisco, they too recommend using the officially assigned ports.

Question#2
=========
“What do you mean by combining the Authentication & Authorization” of radius?

In radius when an authentication query is made to the radius server, the reply not only contains the authentication response, but also an authorization response in the form of Attribute Value pairs or AVP’s for example the AVP could contain a Privilege Level for the user or a DACL for a network user.

On the other hand, TACACS+ separates these functions allowing more granular control especially on the commands when it comes to authorization.

RADIUS vs TACACS+ Point#2
========================
When it comes to communication over the wire, RADIUS sends the username of the user in clear text, but the password is hashed.

[zosmanovic]

this should be on the homepage for everyone

[carlosmalovini]

I'm preparing for my CCNA exam - you're one of my teachers.Thank you for your excellent work and for helping me to succeed.

[kaflean]

Without the illustrations I wouldn't have understood a thing. Thank you for making this so detailed

[almccanuel]

Another one of many informational content in youtube. Thanks for sharing more videos to come.

[MuhammadKhan-ylmt]

This is BEST explanation i have yet read through..
Thank you.

[Regulator]

I don't know if you still read comments here. But I've been having trouble with the differences between TACACS+ and RADIUS. This video completely cleared up every question I had about it plus a few more I didn't even know I had. Thank you so much for the video! Great content!

[kso]

OHHHH This was so good!!! You are a great teacher!! Thank you!! Needed this to study for my security+ cert.

[jameskimuyu]

It is now well understood at long last. Youre the best.

[danielniki]

You are great sir! You have explained the concepts in a very clear way.

[galacticaldread]

i am preparing for my Security+ exam, thank you so much for the clear video on the difference between RADIUS and TACACS+ :')

[prayagshah]

Great Video with only useful information. Thank you

[netanissimov]

2:51
exactly the questation I had in mind!
thank you!

[fpvshenanigans]

very informative and well made video, thanks for sharing

[JEETENDERRSVP]

Good explanation will definitely help for my upcoming Network Security Interview.

[Turanimo]

Can you please tell me, which program did you use to create this video? :) that video was excellent

[PlanoFool]

TACACS+, while a proprietary protocol, has been implemented for, as far as I know, Juniper devices. So I think the statement at 6:19, "Only Works With Cisco Devices", isn't necessarily true.

[skeletron]

doctor you've healed my confusion!