A regional bank runs 802.1X on its access switches with RADIUS sessions landing in ISE, while engineers configure routers and firewalls over SSH from a jump host. The security lead wants every configuration command approved before it runs and recorded afterward, with both AAA services administered from the same ISE console. Which AAA protocol should serve the device administration sessions?
Select an answer to reveal the explanation.
Short Explanation
You're splitting AAA by job: RADIUS carries endpoint traffic and TACACS+ carries the engineers' CLI work. TACACS+ encrypts the packet body and can authorize and account for individual commands, which RADIUS does not provide for Cisco device administration. It works like a supervisor initialling each line of a change ticket instead of only signing the cover sheet.
Full Explanation
TACACS+ is the best fit because it separates authentication, authorization, and accounting, and network devices commonly use it to request authorization for individual commands and report command accounting records. With ISE providing TACACS+ services, administrators can manage device-administration policy and accounting alongside the bank’s RADIUS-based 802.1X service in the same console. RADIUS is widely used for network access and can also authenticate SSH administrators, with session-level policy and accounting; however, that approach does not provide the required per-command authorization and command records. TACACS+ with accounting retained only on each device can authorize commands individually, but the command records are not available in ISE as required. Sending TACACS+ command accounting to a separate syslog collector is also a common architecture, and preserves per-command authorization and records, but it places those records outside ISE rather than meeting the requested centralized administration and recording arrangement. Exam caveat: protocol support and command-accounting details vary by device platform and software version, so do not assume that enabling TACACS+ alone guarantees every command is authorized or logged. Practical check: verify the device’s TACACS+ command-authorization and accounting configuration, then run a test command and confirm ISE records both the authorization result and its accounting event.