So let's run a simulation, in packet tracer, I'll go to simulation mode, here's the console of router
1 and I'll login with my username David, password
Cisco notice I'm logging into the console of the router but a TCP packet is generated and is sent
to the server.
Inbound PDU received by the server has a source of the router destination is the AAA server, Port number's
49.
So this is a Tacacs TCP packet.
Packet goes back.
A Tacacs packet is now sent
to the Tacacs server, if I click on that notice, the inbound PDU shows us that the source of the
packet is the router.
Destination is the Tacacs server scrolling down in the TCP header, we can see that the destination
is Port 49.
This is a Tacacs packet notice data is encrypted, Tacacs encrypts the data between the router and the
server, but there we can see clearly that it's a Tacacs packet going to the Tacacs server.
The AAA server is sending back a Tacacs packet to the router, so the source is the Tacacs server or AAA
server destination is the router.
We can see the TCP source port is 49, going to the ephemeral or random port number on the router.
We can see it's a Tacacs packet.
So the packet gets sent back to the router, that process will continue until authentication has been
completed.
Notice here we are seeing spanning tree messages.
But at this point, I have now logged into the router, if I type enable,
more TCP and Tacacs packets are now generated.
Some of the messages have been generated by the switch, I'll go through those quickly.
I'll restart the simulation.
So I'll try that again, enable notice as soon as I typed enable.
Tacacs packets are generated.
Username is going to be David, Password is going to be Cisco.
As soon as I enter that,
notice we can see Tacacs packets being sent
between
the router and the Tacacs server, so again, inbound PDU on the switch source IP address is, the router
destination is the server.
TCP port is port 49, Tacacs
Protocol data is encrypted
and that will continue until authentication has completed and notice I can get into enable mode on the
router.
So that was simulation mode with Tacacs.
Let's have a look at radius.
So I'll go back to simulation mode on router 2 connect to the console and log in, as Peter Pan notice,
a radius packet has generated.
Inbound PDU on the switch source IP address is router 2 destination IP address
is the server. Notice this is using UDP, destination port is 16454, so it's not TCP, it's UDP.
Radius uses UDP, not TCP notice the destination port is 1645.
That is the default.
So we can see radius packets being generated between
the router and the server and notice I've logged in. Type enable
capture forward.
We've got radius packets
being generated again.
Put my username and password in.
Radius packets are being generated
and notice, I've logged in, so again how run type include AAA.
Include radius notice the authentication port used by default in radius is 1645.
So that's why when I type exit and logged back in with my username password, the destination port number
used in the packet is 1645.
This is a UDP packet.
So let's have a look at this packet.
This was the reply from the AAA server, data is shown in clear text.
It's not encrypted.
Source and destination port number, this is a reply from the server to the router.
So there you go, we've proven that when you log in to a device, we can see the Tacacs and Radius messages
between the devices and the Radius and Tacacs of AAA.
So how did you do in this lab?
Were you able to complete the lab?
Did you get it working?
Do you understand the differences between radius and tacacs?
Make sure that you understand the theory of both radius and tacacs, but I'm hoping that this lab has
helped you understand the concepts and implementation of both tacacs and radius.