TACACS+

TACACS+
Name	TACACS+
Developer	Cisco Systems
Introduced	1993
Status	Active
License	Proprietary
Ports	49
Layer	Application layer

TACACS+ is a proprietary network protocol developed for remote authentication of users and devices. Originally created by Cisco Systems and widely implemented across Cisco Catalyst, Cisco IOS, Juniper Networks and other vendor platforms, it provides centralized access control for network devices used in large organizations like AT&T, Verizon Communications, IBM, HP Enterprise, and Lockheed Martin. TACACS+ is commonly compared with protocols such as RADIUS (Remote Authentication Dial-In User Service), Diameter (protocol), and legacy systems like TACACS and XTACACS in environments including Department of Defense (United States), NASA, and multinational corporations.

History

TACACS+ traces its lineage to the original TACACS protocol developed for remote terminal access linked to projects at BBN Technologies and later extended by Cisco Systems during the early 1990s alongside work at IETF and interoperability efforts with vendors like 3Com and Bay Networks. The evolution from TACACS and XTACACS to TACACS+ paralleled contemporary authentication developments such as Kerberos deployments within MIT and adoption of RADIUS by telecom carriers including Telstra and Deutsche Telekom. Throughout the 1990s and 2000s, TACACS+ saw adoption in enterprise networks managed by companies like Cisco Systems, Juniper Networks, Arista Networks, and government projects overseen by agencies such as NSA and GCHQ.

Protocol Overview

TACACS+ operates at the Application layer and uses TCP port 49 for reliable transport between network devices and centralized servers such as Cisco Secure ACS, FreeRADIUS adaptations, and commercial appliances from Aruba Networks and F5 Networks. The protocol separates authentication, authorization, and accounting functions to allow granular command-level control on devices like Cisco Nexus, Juniper Junos, Arista EOS, and HP ProCurve. TACACS+ messages encapsulate packets with headers that include sequence numbers, flags, and encrypted payloads; implementations interoperate with directory systems such as Microsoft Active Directory, OpenLDAP, and identity platforms like Okta and Ping Identity.

Authentication, Authorization, and Accounting (AAA)

In TACACS+, authentication often integrates with back-end databases including Microsoft SQL Server, Oracle Database, and PostgreSQL, or directory services such as Active Directory and OpenLDAP. Authorization policies map roles and command sets for devices from vendors like Cisco Systems and Juniper Networks, while accounting records can be exported to logging systems like Splunk, ELK Stack, and SIEM products from IBM QRadar and ArcSight. Enterprises deploy TACACS+ to enforce least-privilege models used by organizations such as Deloitte, Accenture, and PwC, enabling audit trails for compliance regimes like PCI DSS, HIPAA, and NIST Special Publication 800-53.

Security and Encryption

TACACS+ encrypts the entire payload of each packet using symmetric keys shared between clients and servers, a design choice distinct from protocols that encrypt only sensitive attributes, influencing usage in environments audited by ISO/IEC 27001 and assessed under standards from National Institute of Standards and Technology. Key management often integrates with hardware security modules from vendors such as Thales Group and HSM appliances, or with certificate infrastructures like Entrust and DigiCert when used alongside TLS-based systems. Security practitioners at firms like McAfee, CrowdStrike, and Mandiant recommend network segmentation, strong shared secrets, and monitoring with tools such as Wireshark and tcpdump to detect anomalies similar to analyses performed for Heartbleed and Shellshock vulnerabilities.

Implementations and Interoperability

Commercial TACACS+ servers include Cisco Secure ACS, Cisco ISE, and third-party implementations from Sun Microsystems-era vendors and open-source projects adapted by communities around FreeRADIUS and PacketFence. Network equipment vendors including Cisco Systems, Juniper Networks, Arista Networks, Hewlett Packard Enterprise, and Brocade Communications Systems provide client-side support, while identity management platforms such as Okta, Ping Identity, and ForgeRock facilitate integrations. Interoperability testing and certification events conducted by organizations like IETF working groups and vendor consortia mirror efforts seen in standards activities by IEEE and ETSI.

Configuration and Deployment

Typical deployment models place TACACS+ servers in redundant clusters across data centers operated by firms such as Equinix and Digital Realty, often using virtual appliances on platforms from VMware and KVM. Configuration incorporates role-based access control templates drawn from best practices by CIS (Center for Internet Security), integration with Active Directory or LDAP realms, and logging to collectors like Splunk and Graylog. Large-scale deployments at providers including AT&T, Verizon Communications, and cloud operators such as Amazon Web Services integrate TACACS+ for device management alongside orchestration tools from Ansible, Puppet, and Chef.

Comparison with RADIUS and Diameter

Compared with RADIUS (Remote Authentication Dial-In User Service), TACACS+ uses TCP and encrypts the entire payload whereas RADIUS typically uses UDP and encrypts only certain attributes; organizations such as Cisco Systems and Juniper Networks choose between them based on command authorization granularity and performance characteristics relevant to carriers like Verizon Communications and AT&T. Diameter, designed within IETF as a successor to RADIUS (Remote Authentication Dial-In User Service), targets telecom use cases by supporting peer-to-peer and mobile architectures used by 3GPP, GSMA, and operators such as T-Mobile and Vodafone, while TACACS+ remains focused on administrative device management in enterprises and government agencies including NASA and Department of Defense (United States).

Category:Network protocols