TACACS+ (Terminal Access Controller Access-Control System Plus) is a Cisco-developed AAA protocol that authenticates administrators, authorizes their commands, and logs their actions on network devices. It encrypts the full packet body over TCP port 49 and, unlike its predecessors, treats authentication, authorization, and accounting as three fully independent processes.
Key takeaways
- TACACS+ separates authentication, authorization, and accounting fully.
- Encrypts the entire packet body over TCP port 49, unlike RADIUS.
- Used mainly for administering network devices, not network access control.
- Documented informationally in RFC 8907, not a formal IETF standard.
- Versa Director, Analytics, and VMS all support TACACS+ for admin login.
On this page: Why it mattersHow it worksTypesTACACS+ & VersaFAQ
Why is TACACS+ important?
Routers, switches, firewalls, and SD-WAN devices all need a way to control who can log in and what they can do once they are in. TACACS+ externalizes that control from a scattered set of local user tables into a centralized server, so an administrator’s access can be granted, changed, or revoked once instead of on every device individually.
What sets it apart is granularity. Because TACACS+ treats authorization as its own step, a policy can authorize individual commands rather than just the session – an operator can be permitted to view a configuration while being blocked from reloading the device or changing an interface. Combined with full-session encryption and per-command accounting, this makes TACACS+ the protocol of choice wherever administrative access to infrastructure needs a detailed, auditable trail, which is why it remains the default for device administration even as RADIUS dominates network-access scenarios like VPN and Wi-Fi login.
What is TACACS+?
TACACS+ works as a client-server exchange: a network device (the client) forwards a login attempt to a TACACS+ server over a single TCP connection on port 49. Using TCP instead of RADIUS’s connectionless UDP gives the exchange built-in delivery guarantees, and TACACS+ encrypts the entire packet body – not just the password field – so command names, arguments, and accounting records are all protected in transit.
The server evaluates the request against its own database, or delegates to a directory service, and returns a decision along with any authorization attributes tied to the user’s role. Because authentication, authorization, and accounting are separate exchanges, a device can be configured to authenticate a user locally while still sending authorization and accounting requests to a remote TACACS+ server – or any other combination the deployment needs.
Types of TACACS+
TACACS+ is built from three independent processes. Authentication verifies the user’s identity through a username, password, or certificate. Authorization determines what that user can do, evaluated per session or, distinctively, per individual command before it executes. Accounting logs what actually happened – login time, commands run, and session duration – for auditing.
The name also reflects a lineage. TACACS, defined in RFC 1492, dates to 1980s ARPANET-connected systems. Cisco extended it into XTACACS in the early 1990s, then redesigned it from scratch as TACACS+ later that decade – a protocol change so complete that TACACS+ is not backward-compatible with either predecessor. TACACS and XTACACS are effectively obsolete today; when people say “TACACS,” they almost always mean TACACS+.
TACACS+ & Versa
Versa Director, Versa Analytics, and Versa Messaging Service (VMS) all integrate with an external TACACS+ server to authenticate administrators. On Versa Director, TACACS+ is configured as an authentication connector alongside Active Directory, LDAP, and RADIUS, with redundant servers working active-active, a choice between local-then-remote and remote-then-local order, and – on Release 22.1.4 and later – a separate default shell connector so CLI logins can authenticate against a different TACACS+ server than GUI and API logins. TACACS+ servers can also carry two-factor authentication attributes.
On Versa Analytics, up to four TACACS+ servers per node authenticate SSH access to the node’s shell, restricting each user to the admin (full shell and configuration edit) or oper (read-only, restricted commands) role via a versa-user-group attribute configured on the TACACS+ server itself. VMS, starting at Release 5.2.2, integrates with TACACS+ so an external user can run privileged commands on behalf of the VMS administrator, with the TACACS+ server’s service value set to “versa” and reachable over the VMS northbound interface.
Frequently asked questions
What is the difference between TACACS+ and RADIUS?
TACACS+ encrypts the entire packet and separates authentication, authorization, and accounting into independent steps, including per-command authorization – the usual choice for administering network devices. RADIUS encrypts only the password and combines authentication with authorization, and dominates network-access cases like VPN and Wi-Fi login.
What port does TACACS+ use?
TACACS+ uses TCP port 49. The TCP transport gives it connection-oriented delivery guarantees that RADIUS, which runs over UDP, does not have, and it carries the full AAA exchange – authentication, authorization, and accounting alike – over that single encrypted session between client and server.
Is TACACS+ still relevant, or has it been replaced?
TACACS+ remains the standard protocol for administrative access to network infrastructure. Its predecessors, TACACS and XTACACS, are obsolete, but TACACS+ itself is actively used across enterprise networks today and was formally documented in RFC 8907 in 2020, decades after Cisco originally introduced it.
What is command authorization in TACACS+?
Command authorization checks each individual command an administrator issues against a policy on the TACACS+ server before the device executes it, rather than authorizing only the login session as a whole. This lets an operator, for example, view configuration without being permitted to reload the device.
Does Versa support TACACS+ for administrator access?
Yes. Versa Director, Versa Analytics, and Versa Messaging Service all support TACACS+ as an external AAA server for administrator login, each with role attributes – such as versa-user-group – that map an authenticated TACACS+ user onto a permission level on that component.
More on TACACS+
If you want to learn more, these are sources we trust.
| RFC 1492: An Access Control Protocol, Sometimes Called TACACS | RFC 8907: The TACACS+ Protocol |
|---|---|
| The 1993 document describing the original TACACS protocol that Cisco later extended into XTACACS and then redesigned as TACACS+. | The 2020 informational RFC that formally documents the TACACS+ protocol as implemented, decades after its original release. |
Related terms
If you’re reading about TACACS+, these are worth looking at next.
| Authentication, Authorization, and Accounting | Versa Director | Versa Analytics |
|---|---|---|
| The security framework – identity, permissions, and logging – that TACACS+ is one protocol for carrying. | The management console where TACACS+ is configured as an external authentication connector for administrators. | The Versa headend component that authenticates its own node shell logins against an external TACACS+ server. |