A company needs centralized administrator logins to routers and switches, with authorization and accounting for each individual command an administrator enters, and the entire packet body encrypted. Which protocol fits?
Select an answer to reveal the explanation.
Short Explanation
TACACS+ is the strict hotel concierge: checks your ID, decides room by room what you can open, keeps a log of every door, and seals the whole conversation in an envelope. RADIUS only hides your password on the postcard. For device admin with per-command control, you want the concierge.
Full Explanation
TACACS+ is designed for device administration. It runs over TCP port 49, treats authentication, authorization and accounting as separate functions, and encrypts the entire body of each packet, leaving only the header in the clear. Separating authorization allows each command an administrator enters to be authorized individually, and accounting records can capture each command, giving an audit trail of exactly what was done on every router and switch. RADIUS combines authentication and authorization in its response, runs over UDP 1812 and 1813, and encrypts only the user password attribute, leaving other attributes readable. It is the standard for network access such as 802.1X and VPN, but it does not natively provide per-command authorization for device administration. LDAP is a directory access protocol; it can verify credentials or look up group membership, but it has no concept of authorizing or accounting individual device commands. Kerberos provides ticket-based authentication within a realm; it does not authorize device commands or record command accounting on network equipment. Exam caveat: many deployments use both protocols on the same ISE nodes, TACACS+ for device administration and RADIUS for network access. Operational check: configure command authorization and accounting method lists pointing to the TACACS+ server, enter a test command, and confirm it appears in the server's accounting log.