RADIUS AND TACACS ( AAA Server )

AAA ( Authentication Authorization Accounting ) Server

RADIUS Server is commonly used to authenticate users connecting to Wi-Fi, VPNs, or wired 802.1X networks.

When you connect to a corporate Wi-Fi and enter:

  • Username: rohith
  • Password: Cisco123 

          Username + Password
                 │
                 ▼
            Access Point (AP)
                 │
          RADIUS Request
          UDP Port 1812
                 │
                 ▼
          RADIUS Server
      (Cisco ISE / FreeRADIUS /
       Microsoft NPS)
                 │
      Accept / Reject
                 │
                 ▼
          Access Point
                 │
                 ▼
             Laptop Connected

TACACS+ Server is typically used to authenticate and authorize network administrators logging into routers, switches, and firewalls. It also supports command-by-command authorization, making it well suited for managing administrative access.

Download putty tool

ssh - secured login

ssh -l admin 192.168.10.1  ( admin is username ) 

enter password

telnet - unsecured login.

no username and password.. 

Difference Between RADIUS and TACACS+

FeatureRADIUSTACACS+
ProtocolUDPTCP
Port1812 (authentication), 1813 (accounting)49
EncryptsPassword onlyEntire packet payload
AuthenticationYesYes
AuthorizationLimitedGranular command authorization
AccountingYesYes
Best UseNetwork access (Wi-Fi, VPN, 802.1X)Device administration (routers, switches, firewalls)

Comments

Post a Comment

Popular posts from this blog

🖧 VLAN (Virtual Local Area Network)

  🖧 VLAN (Virtual Local Area Network) 🧠 Top 5 Key Points Logical Network Segmentation: VLANs divide a physical network into multiple logical networks , thus breaking broadcast domain. Improved Security: Devices in different VLANs cannot communicate unless explicitly allowed via a router or Layer 3 switch . Reduces Broadcast Domains: Each VLAN is its own broadcast domain , minimizing unnecessary traffic. Better Management: Departments (HR, Sales, IT, etc.) can be grouped into different VLANs without changing physical cabling . Requires VLAN Tagging (802.1Q): VLAN information is carried between switches using 802.1Q trunking . VLAN Benefits: Improved security by isolating sensitive systems  Reduced broadcast traffic and better performance Smaller broadcast domains mean less unnecessary traffic and bandwidth saved.. Easy to troubleshoot.  Trunk can carry traffic for up to 4094 VLAN IDs ( ie 4094 subinterfaces ). . Complete Flow PC1 (No Tag) | ...
Read more

🌐 NAT (Network Address Translation)

Image
  🌐 NAT (Network Address Translation) 🧠 Top 6 Key Points Translates Private IPs to Public IPs: NAT converts internal (private) IP addresses into a single or multiple public IPs so that devices inside a LAN can access the Internet. Conserves Public IP Addresses: NAT allows multiple internal hosts to share one public IP, saving global address space. Improves Security: Internal IPs remain hidden from the outside world, reducing attack exposure. Types of NAT: Static NAT: One-to-one mapping (internal ↔ public).  ( Server) Dynamic NAT: Many-to-many mapping (pool of public IPs).  (  PAT (NAT Overload): Many-to-one mapping (most common).  Configured on Routers: NAT runs on routers at the boundary between private and public networks , translating IPs for outbound/inbound traffic. NAT Type Used Today 6 Common Use Static NAT ✅ Yes  (limited use 7 Publishing internal servers with a dedicated public IP Dynamic NAT ⚠️ Rarely L...
Read more

🛰️ OSPF (Open Shortest Path First)

  🛰️ OSPF (Open Shortest Path First) 🧠 Top 5 Key Points about OSPF Link-State Protocol → OSPF shares detailed information about network topology (not just hop count). Metric: Uses cost , calculated based on bandwidth (higher bandwidth = lower cost). Fast Convergence: Quickly detects and adapts to network changes. Supports VLSM & CIDR: Fully classless , allowing subnet flexibility. Area-Based Design: Supports hierarchical networks (Area 0 = Backbone, others connect to it). ⚙️ Additional Notes Works at Layer 3 (Network Layer) of the OSI model. Uses Dijkstra’s SPF (Shortest Path First) algorithm. Multicast addresses: 224.0.0.5 → All OSPF routers 224.0.0.6 → Designated Router (DR) and Backup DR OSPF uses Link-State Advertisements (LSAs) to exchange topology information. Each LSA type has a specific purpose. Here's a practical explanation of LSA Types 1–7 . 1. Type 1 – Router LSA Generated by: Every OSPF router Flooded within...
Read more