What is TACACS+; how does it differ from RADIUS?

Short answer

TACACS+ (Terminal Access Controller Access-Control System Plus) is the protocol that gathers the authentication, authorization and accounting (AAA) functions for management access to network devices on a central server (RFC 8907). Its differences from RADIUS: it uses TCP (standard port 49), hides the entire packet body with the shared secret (RFC 8907: obfuscation) and carries out the three AAA functions with separate messages; for this reason, it is common in management access control. In TR7, TACACS+ is used only for management users: on the TACACS Settings screen, TACACS Host, TACACS Port (default 49) and TACACS Secret are defined, and in the Device Users form, TACACS is selected as Authorization Source. TR7 uses the TACACS+ server to verify the user's password and, optionally, to send an Accounting record; the user's permissions are determined by User Type in TR7. In AGS, there is no Authentication Provider of the TACACS+ type; RADIUS can be used for application users.

Where It Is Used in TR7

Where	Field / label	What for
Settings → User Management → TACACS Settings	TACACS Host, TACACS Port (default 49), TACACS Secret	The address and the shared secret of the TACACS+ server
Same screen	Accounting (off by default) and its subfields	Sending the user operation and login logs to the TACACS+ server as accounting records
Same screen	Check TACACS Connection	Trying access to the server; if Accounting is on, a login is attempted with Accounting username and Accounting password
Settings → User Management → Device Users	Authorization Source = TACACS; the TACACS+ source in the User Creation Source field	Verifying the user with TACACS+; automatic creation of the user at first login

Comparison

	TACACS+	RADIUS
Transport	TCP, port 49	UDP, port 1812 for authentication
Hidden with the shared secret	The entire packet body (obfuscation)	Only the User-Password field
AAA functions	With separate messages (authentication, authorization, accounting)	Authentication and authorization in the same response; accounting separate
Common use	Management access to network devices	Network access (VPN, Wi-Fi), MFA servers
In TR7	Management users: TACACS Settings	Management users: RADIUS Settings; application users: the RADIUS type in AGS

Common Misconceptions

• "TACACS+ can also be used for AGS application login." TACACS+ is not among the AGS Authentication Provider types; RADIUS or the other types are used.
• "The permissions of a user who logs in with TACACS+ are determined by the TACACS+ server." TR7 asks the TACACS+ server only for password verification; the permissions are the user's User Type value in TR7. The user created automatically at first login is assigned Default User Type to Create.
• "TACACS+ and RADIUS can be used interchangeably." The two are different protocols; the relevant screen in TR7 is configured according to which one the organization's AAA server supports.

How it is done in the documentation

• TACACS Settings · What Is TACACS Settings?
• TACACS Settings · What Is It For?
• Device Users · Authorization Source

Related questions

• What is RADIUS; where is it used in TR7?
• What is AAA (Authentication, Authorization, Accounting); what is an accounting record for?
• What is the shared secret in RADIUS and TACACS+?