Protocol Atlas

L7 · security · draft

TACACS+

Terminal Access Controller Access-Control System Plus

Device-administration AAA that separates authentication, authorization, and accounting exchanges over TCP.

Presenter modeEmbed this figure

The TACACS+ Packet HeaderRFC 8907 · INFORMATIONAL · September 2020AuthenticationRFC 8907 · INFORMATIONAL · September 2020AuthorizationRFC 8907 · INFORMATIONAL · September 2020

Why it exists

Device administration needs per-command policy and accounting, not only a yes/no network-access decision like many RADIUS deployments. IntroductionRFC 8907 · INFORMATIONAL · September 2020

RFC 8907 documents deployed TACACS+ as Informational. It is not an IETF Standards Track interoperability standard. IntroductionRFC 8907 · INFORMATIONAL · September 2020

Authenticate, then authorize the shell

Login is not one packet. Authentication establishes identity; a separate authorization request asks whether the shell or service is permitted.

AdminDevice · TACACS clientTCP, not UDPTACACS+ · TCP
  • Link
  • Blocking
  • Packet in flight
  • Discarded
  • Emphasis
Select a device to read its state. Arrow keys walk the topology.
Text equivalent of this diagram
Devices and links at this step
ElementKindState
Adminhost—
Device · TACACS clientrouter—
TACACS+ · TCPcloud—
Admin — Device · TACACS clientlinkup
Device · TACACS client — TACACS+ · TCPlinkup
1 / 3

The device opens a TCP session to the TACACS+ server. Single-connection mode may reuse the socket for many AAA sessions.

What changed

  • TCP session: Device · TACACS client → TACACS+ · TCP
  • TCP, not UDP

How it works

Authentication, authorization, and accounting are distinct exchanges over a TCP connection, with a common packet header. TACACS+ Packets and SessionsRFC 8907 · INFORMATIONAL · September 2020

Authorization REQUEST carries argument-value pairs naming the service or command; REPLY permits, denies, or modifies them. AuthorizationRFC 8907 · INFORMATIONAL · September 2020

Privilege levels and command sets are policy on the server; the device enforces the REPLY. Privilege LevelsRFC 8907 · INFORMATIONAL · September 2020

On the wire

Constructed examples, encoded from the field table below them — not captured traffic.

Type 2 authorization on session 0xAABBCCDD. Body length is zero in this header-only example.

TCP
TACACS+ runs over TCP. Common deployment uses port 49. RFC 8907
TACACS+ header
Fixed header preceding the (usually encrypted) body. RFC 8907

Configure it

TACACS+ server with separate login authentication and exec authorization.

Cisco IOS-XE 17.12 · Catalyst 9300, ISR 4451draft

  1. aaa new-model
tacacs server LAB
 address ipv4 192.0.2.20
 key <configured out of band>

    Named TACACS+ server. Sessions ride TCP (commonly port 49). Authentication, authorization, and accounting are separate exchanges — unlike RADIUS folding authz into Access-Accept.

    RFC 8907 §4.1

  2. aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local

    Login proves identity; a second authorization request asks whether the shell/exec is permitted. Local is the outage fallback.

    Common mistake: Configuring authentication without exec authorization — users authenticate then land in an unexpected privilege level.

    RFC 8907 §5

  3. aaa authorization commands 15 default group tacacs+ local

    Optional command authorization: each privileged command can be checked as its own authorization request.

    RFC 8907 §6

Verify

show tacacs
Server address, port, and success/fail counters.
show aaa servers
TACACS+ server state where listed.

Caveats

  • Marked draft: syntax has not been checked against Cisco documentation or a device.
  • RFC 8907 is Informational — it documents deployed TACACS+, not Standards Track.
  • Placeholder keys only — never commit real shared secrets.

When it breaks

Symptom first, because that is what you have when it happens.

  1. Login succeeds, but every privileged command is rejected.

    Narrow it down

    1. Separate authentication from command-authorization logs.
    2. Check the command and argument attributes sent.

    Cause

    The identity passed authentication, while the independent authorization policy denied the requested command.

    Fix

    Correct the command set or device attribute mapping; do not weaken authentication to solve authorization.

    AuthorizationRFC 8907 · INFORMATIONAL · September 2020

  2. A server outage locks out all administrators.

    Narrow it down

    1. Read the complete AAA method list.
    2. Test the difference between server error and explicit reject.

    Cause

    The fallback method is absent or only runs on an error class the client never reaches.

    Fix

    Provide a tested local emergency method and document when fallback is invoked; never make explicit policy rejection fall through silently.

    Cisco IOS XE — Configuring TACACS+ §Configuring TACACS+

  3. Accounting records login but no commands.

    Narrow it down

    1. Check command accounting at the required privilege levels.
    2. Compare authorization and accounting method lists.

    Cause

    Session accounting was enabled, but per-command accounting was not.

    Fix

    Enable command accounting for the intended privilege levels and verify start/stop or stop-only behavior.

    AccountingRFC 8907 · INFORMATIONAL · September 2020

  4. AAA never contacts the server though ICMP ping works.

    Narrow it down

    1. Confirm TCP to the TACACS+ port from the configured source.
    2. Check intermediate firewalls that allow ICMP but not the AAA TCP port.

    Cause

    TACACS+ requires TCP; path filters that only permit ping leave AAA dead.

    Fix

    Permit the TACACS+ TCP port end to end from the device source address.

    ConnectionRFC 8907 · INFORMATIONAL · September 2020

  5. Server logs show undecodable or rejected TACACS+ bodies.

    Narrow it down

    1. Compare the shared key on device and server.
    2. Confirm both sides expect the same obfuscation behavior.

    Cause

    Mismatched shared secret breaks body obfuscation between client and server.

    Fix

    Align the key and restart the AAA session; rotate both ends together.

    Data ObfuscationRFC 8907 · INFORMATIONAL · September 2020

Design notes

A working login with failing commands is usually authorization, not a password problem.

Always leave a tested local emergency method for server outages — and never confuse error with Reject. Cisco IOS XE — Configuring TACACS+ §Configuring TACACS+

Misconceptions

“If TACACS+ authentication succeeds, commands are authorized.”
Authentication and authorization are separate message types and policies; either can succeed while the other fails. AuthorizationRFC 8907 · INFORMATIONAL · September 2020
“TACACS+ is an IETF Standards Track protocol.”
RFC 8907 documents deployed TACACS+ as an Informational RFC; it does not turn the protocol into an IETF standard. IntroductionRFC 8907 · INFORMATIONAL · September 2020
“TACACS+ is just RADIUS over TCP.”
The message model separates AuthN/AuthZ/Accounting and is aimed at device administration; RADIUS commonly folds AuthZ into Access-Accept attributes over UDP. IntroductionRFC 8907 · INFORMATIONAL · September 2020

More walkthroughs

Login works; every privileged command is rejectedfailure

Command authorization asks the server about each command and its arguments. Passing identity does not imply a permit on configure terminal.

Admin · logged inDeviceAsk before executePending: configure terminalTACACS+
  • Link
  • Blocking
  • Packet in flight
  • Discarded
  • Emphasis
Select a device to read its state. Arrow keys walk the topology.
Text equivalent of this diagram
Devices and links at this step
ElementKindState
Admin · logged inhost—
DevicerouterPending: configure terminal
TACACS+cloud—
Admin · logged in — Devicelinkup
Device — TACACS+linkup
1 / 3

The admin types a privileged command. The device does not execute it yet — it builds an authorization request with the command and arguments.

What changed

  • Device: Pending → configure terminal
  • Ask before execute

Method list decides lockout vs emergency accessdesign-choice

When the server is unreachable, the AAA method list — not authentication success alone — decides whether local fallback runs, and on which error class.

AdminDeviceServers unreachableError ≠ Rejectlocal if-authenticated
  • Link
  • Blocking
  • Packet in flight
  • Discarded
  • Emphasis
Select a device to read its state. Arrow keys walk the topology.
Text equivalent of this diagram
Devices and links at this step
ElementKindState
Adminhost—
Devicerouter—
Servers unreachablezone—
local if-authenticatedlabel—
Admin — Devicelinkup
Device — Servers unreachablelinkdown
1 / 3

TCP to the TACACS+ servers fails. That is an error path, not an explicit policy Reject. The method list must say what happens next.

What changed

  • Error ≠ Reject
  • Emphasis on Device ↔ Servers unreachable

Terms

Command authorization
A TACACS+ authorization decision for a requested command and its arguments, separate from the authentication exchange that established the administrator identity.

Check yourself

  • What enables per-command policy?
  • Login works but commands fail. Which plane should you inspect?
  • What transport does TACACS+ use?
  • What does RFC 8907’s status imply?
  • During a TACACS+ outage, what decides whether admins can still log in?
  • Why might accounting show login but no commands?
  • Where are command and argument names carried for authorization?
  • Compared with classic RADIUS, TACACS+ is especially suited to…