When using a central authentication server, a client will login to a network device, they will be
prompted for their credentials
but that information is not checked against the local username and password database, but is forwarded
to an authentication server such as Cisco ACS using two protocols, Radius and Tacacs.
So the username and password information is forwarded in encrypted format to the authentication server
and a response is sent back from the triple A server either saying that the login is accepted or not.
That is then passed to the client so the client knows whether the authentication attempt was successful
or not.
Now radius is an open standard protocol that combines authentication and authorization into a single
process.
Once users are authenticated, they are also authorized radius users UDP for authentication and authorization.
Tacacs is a proprietary protocol that separates the services of authentication, authorization and
accounting.
Because of that, you could separate authentication from your authorization and accounting services.
Tacacs also uses TCP rather than UDP.
Tacacs is often used for network devices, while Radius is used for users, Tacacs uses port
number 49 and radius 1645.1812.
Both protocols encrypt the password, but Tacacs encrypts the entire packet.
Tacacs is great for use with network devices such as Cisco routers and switches because you can
authorize a subset of CLI commands.
In other words, you can centralize which users can issue commands on devices in your network.
As an example, only certain users may be allowed to reload a router so you can limit who can do what
on your network devices using Tacacs.
The Cisco ACS server makes us very easy to do and as mentioned, allows you to centralize your authentication
authorization and accounting services.