A hospital network team is moving switch and router CLI access onto ISE. Their security policy requires per-command authorization of every administrator command plus a full audit trail, and every packet exchanged with the AAA server must be encrypted. The devices must also keep accounting records for sessions that run overnight. Which AAA protocol should they configure on the network devices?
Select an answer to reveal the explanation.
Short Explanation
Configure TACACS+ over TCP port 49: it keeps authentication, authorization, and accounting separate, so you can authorize and audit each command and retain records for overnight sessions. Its packet bodies are encrypted, like sealed envelopes carrying each command and its audit trail.
Full Explanation
TACACS+ fits because it runs on TCP port 49 and separates authentication, authorization, and accounting. With command authorization and command accounting configured, an authorization request can be made for each command and command accounting records can provide an audit trail. TACACS+ encrypts the packet body, but not its header. RADIUS uses a shared secret for packet validation and encrypts only the password attribute, not the other attributes; Cisco vendor-specific attributes can support command accounting, but they do not provide full-packet encryption. SSH with local accounts and privilege levels can restrict commands, but it does not provide centralized ISE authorization or consolidated command accounting. 802.1X with EAP-TLS authenticates a supplicant for network access; it does not provide interactive CLI command authorization or command accounting. In a lab, allow one command and deny another with a TACACS+ command set, then confirm ISE records the results when command accounting is configured.