An enterprise network engineering team is deploying AAA services across core routers and wireless LAN controllers. The design requires differentiating protocols used for CLI administrative access versus port-based network access control. Which TWO of the following statements correctly compare the operational characteristics of TACACS+ and RADIUS in this environment?
- RADIUS combines authentication and authorization into unified transaction packets, whereas TACACS+ decouples authentication, authorization, and accounting into distinct and independent processes.Answer
- BTACACS+ relies on UDP port 49 for lightweight message transmission, whereas RADIUS relies on TCP port 1812 to guarantee connection-oriented transport.
- TACACS+ encrypts the entire body of the packet following the header, whereas RADIUS encrypts only the password field within the packet payload.Answer
- DRADIUS is optimized for administrative CLI per-command authorization, whereas TACACS+ is primarily used for 802.1X port-based network client access control.
Answer
The correct statements are that RADIUS combines authentication and authorization into unified transaction packets while TACACS+ decouples them into distinct processes, and TACACS+ encrypts the entire body of the packet following the header while RADIUS encrypts only the password field.
RADIUS integrates authentication and authorization into single transactions (Access-Request/Access-Accept), while TACACS+ decouples all three AAA elements. Additionally, TACACS+ encrypts the entire body of every packet following the header, whereas RADIUS leaves packet headers and non-password attributes unencrypted in transit.
Step-by-Step Solution
Key Concept
Operational differences between TACACS+ and RADIUS protocols within the AAA framework.