-: RADIUS and TACACS+.
RADIUS is the Remote Authentication Dial-In User Service.
It provides centralized administration
of dial-up, VPN, and wireless authentication
so that you can use that with both 802.1x
and the Extensible Authentication Protocol, or EAP.
RADIUS is a client/server protocol that runs
over the seventh layer of the OSI model,
the application layer.
RADIUS is usually configured to be run
on a separate server, but it can also be loaded
up on a Windows server in smaller domain environments.
RADIUS is used to authenticate users,
authorize them to services,
and account for their usage of those services.
This is the typical AAA that we spoke about
all the way back in section one of the course,
Authentication, Authorization, and Accounting.
RADIUS also utilizes UDP for making its connections,
making it fairly fast during its authentication
to authorization functions.
RADIUS commonly uses port 1812
for its authentication messages
and port 1813 for its accounting messages.
Some proprietary versions of RADIUS
may also use ports 1645 and 1646, instead.
Now, exam tip here, I would have these ports
memorized as part of the things you need
to know before test day because you may
see some test questions on them.
Now, while RADIUS is a cross-platform standard,
there is a proprietary protocol from Cisco
called TACACS+ that we've mentioned before.
This is the Terminal Access Controller Access
Control System Plus which can perform the role
of an authenticator in an 802.1x network.
Now, it's up to you to determine which one
is best for your organization's needs.
Personally, I've used RADIUS almost exclusively
within my organizations.
I've found that TACACS+ is a little bit slower
to operate because it's relying on TCP
instead of UDP, and operates over port 49.
But TACACS+ does have some benefits.
It gives you some additional security
and independently conducts its authentication,
authorization, and accounting processes.
TACACS+ supports all network protocols.
But RADIUS, on the other hand,
doesn't support the remote access protocol,
NetBIOS Frame protocol, X.25 PAD connections,
and some others.
Overall, TACACS+ is an excellent choice,
but only if you're going to be using Cisco
devices across your network.
Because if you want to have that cross-platform capability,
then you're going to have to go with RADIUS,
the way that I've chosen in the past.