TACACS+ vs RADIUS: What's the Difference?
If you are studying for CompTIA Security+, TACACS+ vs RADIUS is a classic AAA question. Both protocols centralize access decisions, but the use case, transport protocol, and encryption details point to different answers.
The short answer
TACACS+ is best known for centralized administration of network devices. It uses TCP port 49, separates authentication, authorization, and accounting, and encrypts the entire payload.
RADIUS is commonly used to authenticate users connecting to a network through Wi-Fi, VPN, or 802.1X. It uses UDP and encrypts the password field rather than the complete packet.
An easy memory aid is: TACACS+ controls administrators and devices; RADIUS controls network access. Real environments can use either protocol in several ways, but that distinction matches the most common exam scenarios.
What is TACACS+?
TACACS+ stands for Terminal Access Controller Access-Control System Plus. It is a Cisco-developed protocol used by a client device, such as a switch or router, to ask a central server whether an administrator should be allowed to log in and what commands that administrator may run.
TACACS+ separates the three parts of AAA (Authentication, Authorization, and Accounting):
- Authentication verifies the administrator's identity.
- Authorization determines which commands or services that identity may use.
- Accounting records what the administrator did, when, and for how long.
That separation allows fine-grained command authorization. One administrator might be allowed to view configuration but not change it, while another can enter configuration mode. A TACACS+ server can make that decision centrally instead of requiring a different local account database on every network device.
TACACS+ uses TCP port 49. TCP provides a connection-oriented session, which is useful for reliable communication during device administration.
What is RADIUS?
RADIUS (Remote Authentication Dial-In User Service) is an AAA protocol widely used for controlling network access. A wireless controller, VPN concentrator, or network access server sends a request to a RADIUS server, which validates the user's credentials and returns access attributes.
Common RADIUS scenarios include:
- Employee authentication to an enterprise Wi-Fi network.
- Remote-user authentication through a VPN.
- 802.1X port-based network access control.
- Centralized access for network devices when detailed command authorization is not required.
The standard ports are UDP 1812 for authentication and authorization and UDP 1813 for accounting. Older implementations may use UDP 1645 and 1646.
RADIUS combines authentication and authorization in the access request. It can return attributes such as a VLAN assignment, session timeout, or access policy. It still provides AAA overall, but it does not separate authentication and authorization in the same way TACACS+ does.
TACACS+ vs RADIUS, side by side
| TACACS+ | RADIUS | |
|---|---|---|
| Full name | Terminal Access Controller Access-Control System Plus | Remote Authentication Dial-In User Service |
| Typical use | Network-device administration | Wi-Fi, VPN, and 802.1X network access |
| Transport | TCP | UDP |
| Common ports | TCP 49 | UDP 1812 and 1813 |
| AAA design | Authentication, authorization, and accounting are separated | Authentication and authorization are combined |
| Encryption | Encrypts the entire payload, except the header | Encrypts the password field |
| Authorization detail | Fine-grained command authorization | Access attributes and service authorization |
| Common clue | Administrator logging into a router or switch | User joining Wi-Fi or connecting to a VPN |
Neither protocol is automatically "more secure" in every deployment. Security depends on configuration, shared secrets, certificate use where applicable, network segmentation, and the protection of the AAA server. The comparison matters because each protocol was designed around a different access problem.
Which one shows up on the Security+ exam?
Look for the scenario before looking at the acronym:
- An administrator needs centralized login and command permissions on routers: TACACS+.
- Employees need centralized authentication for corporate Wi-Fi: RADIUS.
- The question mentions TCP 49 and full-payload encryption: TACACS+.
- The question mentions UDP 1812/1813, VPN, or 802.1X: RADIUS.
- The question asks for the protocol that separates AAA functions: TACACS+.
Do not confuse the protocol with the server product. A RADIUS server and a TACACS+ server are both centralized AAA services; the important clue is how the service is being used.
Lock it in
The fastest way to remember this pair is to connect each protocol to a concrete action: TACACS+ authorizes commands on network devices; RADIUS authenticates users onto networks. Drill TACACS+, RADIUS, AAA, 802.1X, and the related IAM acronyms with active recall and spaced repetition in CompTIA Acronyms+, then practice identifying the protocol from the scenario rather than memorizing an isolated definition.