A campus team must run 802.1X on 4,000 wired and wireless ports while giving six engineers CLI access to IOS-XE routers, where each may run only approved commands and every command is recorded. Which AAA protocol pairing should serve network access versus device administration?
Select an answer to reveal the explanation.
Short Explanation
You’ll use RADIUS for 802.1X access across the wired and wireless ports, and TACACS+ for the engineers’ router logins. It’s like using one gatekeeper for network entry and another to check each command and keep a record of it.
Full Explanation
RADIUS is the standard, widely supported choice for 802.1X network access, including large wired and wireless deployments. TACACS+ is suited to IOS-XE administration because it can authorize commands individually and account for each command, allowing engineers to run only approved commands while retaining a command-level record. Using TACACS+ for both access authentication and router administration would leave the campus access design dependent on a protocol not generally used as the 802.1X AAA service; its fit for device administration does not make it the appropriate access protocol here. Using RADIUS for both purposes can provide network access and router authentication, but privilege-level authorization is coarser than per-command authorization: a permitted privilege level does not by itself enforce an approved-command list. Command accounting can record activity, but it does not supply that missing authorization granularity. TACACS+ with per-command authorization but session-only accounting can restrict which commands engineers run, yet it fails the requirement to record every command; a session record is not a command-by-command audit trail. Exam caveat: protocol capabilities and supported AAA features can vary by platform and software release, so do not infer that a feature is available merely because a protocol is configured. Practical check: test each engineer’s allowed and denied commands on the target IOS-XE release, then verify that the AAA server logs both authorization decisions and every executed command.