iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
TACACS+ (Terminal Access Controller Access-Control System Plus) is a protocol that lets organizations manage network-device access through a central server. It separates authentication (checking identity), authorization (deciding what that identity may do), and accounting (recording activity). The modern protocol covered here is TACACS+; “TACACS” is often used informally to refer to it.
What does TACACS+ stand for?
TACACS+ stands for Terminal Access Controller Access-Control System Plus. It is widely used to administer routers, network access servers, and other networked devices through centralized servers. The IETF describes it as a device-administration protocol in its RFC 8907, an informational RFC rather than an Internet Standards Track specification.
What do authentication, authorization, and accounting mean?
- Authentication: Determines who a user or other entity is. TACACS+ can support multi-step exchanges, including challenge-and-response.
- Authorization: Determines what an authenticated identity is allowed to do. A server can return service-specific settings, session limits, or restrictions on commands a network-device administrator may run.
- Accounting: Records and reports activity for administration and auditing. Cisco describes accounting records as a way to track user activity for security audits and reporting.
These are separate functions, and a deployment does not have to use all three. Authentication commonly comes before authorization, but the protocol does not require that order. Nor does successful authentication itself grant a particular privilege level: authorization is evaluated and configured separately.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsHow does TACACS+ work?
- A user connects to a network device. The device, such as a router, acts as the TACACS+ client.
- The device exchanges messages with a TACACS+ server. The server handles whichever AAA functions the deployment uses.
- Authentication establishes identity. The exchange may involve multiple steps, such as a challenge and response.
- Authorization determines permitted access. The server can provide restrictions or parameters, including which commands an administrator may execute.
- Accounting records activity when enabled. The resulting records can support auditing and administration.
TACACS+ uses TCP, and IANA allocates server port 49 for its traffic. The IETF specification describes distinct authentication, authorization, and accounting exchanges and supports extensible, fine-grained access-control requests and responses.
#1 Best Overall
- Used Book in Good Condition
Is TACACS+ encrypted?
Do not treat TACACS+’s traditional built-in protection as strong encryption. RFC 8907 characterizes its legacy mechanism as obfuscation, not meaningful encryption, and says it does not provide meaningful integrity, privacy, or replay protection. An attacker who can access the data stream should be assumed able to read and modify packets. The specification therefore calls for limiting access to known clients and protecting the entire transmission path.
RFC 9887 specifies TACACS+ over TLS 1.3. Availability depends on the particular client, server, and software release; TLS support should not be assumed across all implementations. For example, Cisco documents optional TLS in its APIC Security Configuration Guide for Release 6.2(x), updated April 17, 2026.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should you evaluate in a TACACS+ deployment?
When assessing a deployment or comparing it with another approach, focus on the requirements of the actual network devices and software releases:
- Whether authentication and per-command authorization need to be handled separately.
- What accounting records and audit capabilities administrators require.
- How the transmission path will be secured, including whether supported TLS transport is available.
- Whether the specific devices, clients, and servers are compatible with each other.
There is no universal protocol winner established by these considerations; the right fit depends on access-control needs, auditing requirements, security controls, and compatibility.
Quick Recap
Best Value
- Save valuable floor space: 6U wall mount server cabinet Dimensions: 13.78" H x21.65" W x17.72" D.Maximum mounting depth is 14.2"
- Keep critical network equipment secure: glass door and side panels are lockable to prevent unauthorized access. Front door can be installed on either side of the front of the cabinet to satisfy your door swing orientation preference
- Easy equipment configuration: Fully adjustable mounting rails and numbered U positions, with square holes for easy equipment mounting with top and bottom punch-out panels for easy cable access
- Durability: Made of high quality cold rolled steel holds up to 110lb (50kg) (Easy Assembly Required)
- PCI & HIPPA and EIA/ECA-310-E compliant
Rank #4
- Space Saving: Maximum depth: 14.8". Use the wall mount network cabinet to maximize available space for retail locations, classrooms, back offices, network cabinets, and other locations where space is limited.
- Fast Heat Dissipation: The server cabinet is designed with vents to optimize airflow and avoid critical IT equipment overheating. Heat sink holes in the top, bottom, and rear panels are more conducive to heat dissipation.
- Sturdy Construction: Robust welded frame construction for durability and long service life. With 100 lbs wall-mounted load capacity and 200 lbs ground-mounted load capacity, you can place multiple devices in the server rack cabinet as needed.
- High Security: The locked glass door ensures the security of data and equipment. Wall mount rack enclosure server cabinet is ideal for use in public places such as offices, effectively protecting the security of your devices.
- Hassle-free Installation: Fully adjustable square-hole mounting rails of the wall mount server cabinet facilitate device installation. Wiring holes on the top, bottom, and rear panels provide you with easy cable routing.
Rank #3
- Value NAS with RAID for centralized storage and backup for all your devices. Check out the LS 700 for enhanced features, cloud capabilities, macOS 26, and up to 7x faster performance than the LS 200.
- Connect the LinkStation to your router and enjoy shared network storage for your devices. The NAS is compatible with Windows and macOS*, and Buffalo's US-based support is on-hand 24/7 for installation walkthroughs. *Only for macOS 15 (Sequoia) and earlier. For macOS 26, check out our LS 700 series.
- Subscription-Free Personal Cloud – Store, back up, and manage all your videos, music, and photos and access them anytime without paying any monthly fees.
- Storage Purpose-Built for Data Security – A NAS designed to keep your data safe, the LS200 features a closed system to reduce vulnerabilities from 3rd party apps and SSL encryption for secure file transfers.
- Back Up Multiple Computers & Devices – NAS Navigator management utility and PC backup software included. NAS Navigator 2 for macOS 15 and earlier. You can set up automated backups of data on your computers.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
