3Com Switch 8800 Configuration Guide Chapter 40 AAA and RADIUS/TACACS+ Protocol Con
figuration
40-3
Table 40-1 TACACS+ vs. RADIUS
TACACS+ RADIUS
Adopts TCP, providing more reliable network
transmission. Adopts UDP.
Encrypts the entire packet except for the
standard TACACS+ header. Encrypts only the password
field in authentication packets.
Separates authentication from authorization. For
example, you can use RADIUS to authenticate
but TACACS+ to authorize.
Binds authentication with
authorization.
Suitable for security control. Suitable for accounting.
Supports the authorization of different users to
use the configuration commands of the routing
module of the switch. Not support.
Working as a client of TACACS+, the switch sends the username and password to the
TACACS server for authentication, as shown in the following figure:
TACACS Server
129.7.66.66
TACACS Server
129.7.66.67
User
Terminal User
TACACS Client
TACACS Server
129.7.66.66
TACACS Server
129.7.66.67
User
Terminal User
TACACS Client
Figure 40-1 Network diagram for TACACS+
II. Basic message exchange procedures in TACACS+ For example, use TACACS+ to implement authentication, authorization, and
accounting for a telnet user. The basic message exchange procedures are as follows:
z A user requests access to the switch; the TACACS client sends a
start-authentication packet to TACACS server upon receiving the request.
z The TACACS server sends back an authentication response requesting for the
username; the TACACS client asks the user for the username upon receiving the
response.
z The TACACS client sends an authentication continuance packet carrying the
username after receiving the username from the user.