# Enterprise Networking 101 Many network engineers are frequently asked in interviews whether they understand what RADIUS and TACACS+ are, how they differ, and which protocol operates at which OSI layer or offers better security. However, these questions often overlook the real-world use cases of these protocols. In this article, I aim to simplify the concept of AAA (Authentication, Authorization, and Accounting) and provide a clear, practical understanding of RADIUS and TACACS+. Whether you're a beginner or a mid-level network engineer, this guide breaks down these technologies in the context of typical enterprise environments to help you grasp their purpose and functionality more effectively. Next, let’s explore and understand what RADIUS and TACACS are. **RADIUS (Remote Authentication Dial-In User Service)** * A network protocol that provides centralized authentication, authorization, and accounting (AAA) for users connecting to network services * Uses UDP protocol (ports 1812/1813) * Encrypts only the password, leaving other attributes in plaintext * Primarily designed for dial-up and VPN access but widely used for WiFi and network device authentication **TACACS+ (Terminal Access Controller Access-Control System Plus)** * Cisco's proprietary AAA protocol for network device administration * Uses TCP protocol (port 49) * Encrypts the entire packet payload for better security * Separates authentication, authorization, and accounting into distinct processes * Mainly used for managing administrative access to routers, switches, and firewalls **Key Differences:** * **Security**: TACACS+ encrypts everything; RADIUS only encrypts passwords * **Protocol**: TACACS+ uses reliable TCP; RADIUS uses UDP * **Vendor**: TACACS+ is Cisco proprietary; RADIUS is an open standard * **Use Case**: RADIUS is better for end-user access; TACACS+ is preferred for network device administration * **Granularity**: TACACS+ offers more granular control over user privileges Both serve the same basic AAA functions but are optimized for different network scenarios. --- ## Enterprise-grade NAC solutions offered by various vendors. --- 1. Cisco (Identity and Service Engine) ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1753199641973/e63296db-e44b-44e7-9165-7d8f5bf2ccce.avif align="center") --- 2. Aruba Clear Pass ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1753200035990/edafb092-2d0b-48cb-9025-09bb63928b50.png align="center") --- 3. Juniper Mist NAC / Mist Edge ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1753200581690/251e359d-51cd-4d9c-a2bb-15bd2a30b713.png align="center") 4. Huawei Agile Controller-Campus ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1753201016563/807fe256-57c9-46bd-987e-01b55c5ade0d.jpeg align="center") 5. Extreme Control (Extreme Networks) ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1753242247329/29b51740-4259-415a-8835-73d343fe79ea.png align="center") ## Traditional (Static) Approach: * VLAN is **statically assigned** to a **switch port**. * If a user moves to a different port/switch/location, **manual reconfiguration** is needed. * No context-awareness (e.g., device type, user role, time of access). 🔴 This doesn't scale well in dynamic environments like campuses or large enterprises. --- ## Enterprise-grade NAC systems ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1753249070482/50aaacc8-ec1e-425f-9833-94beeb7ab662.png align="center") Step-by-Step Flow (with Active Directory) ✅ Step 1: Device/User Connects User connects to a switch port or Wi-Fi. They provide credentials (username/password) or the device sends a MAC address. ✅ Step 2: Switch Sends RADIUS Request The switch doesn’t verify credentials itself. It sends a RADIUS request to Extreme NAC (RADIUS server). ✅ Step 3: NAC Uses LDAP or Kerberos to Query Active Directory NAC receives the credentials and uses LDAP (Lightweight Directory Access Protocol) to check against AD. It asks: 👉 “Is john.doe a valid user?” 👉 “What group is john.doe in?” ✅ Step 4: AD Responds AD responds with: User validity ✅/❌ Group membership (e.g., HR, IT) Optional: other attributes like department, title, etc. ✅ Step 5: NAC Makes a Decision Based on AD info + NAC policies: Assigns a VLAN (e.g., VLAN 10 for HR) Adds ACLs or QoS roles NAC sends this decision back to the switch via RADIUS Access-Accept. ✅ Step 6: Switch Applies Config, Switch dynamically applies the assigned VLAN and policies to that port or session. --- ### 🚶‍♂️Example UseCase: User Roaming Across the Network Let’s say **John from HR** connects his laptop: 1. He logs in at desk A → Authenticated via NAC → VLAN 100 (HR VLAN) + ACLs applied. 2. Later, he moves to a meeting room and plugs in his laptop → The switch at that location contacts Extreme NAC → Same policy applies → VLAN 100 again. **No need for manual switchport config change.** --- ## **What do all** Enterprise-grade NAC systems **have in common?** 1. **User & Device Authentication** → Only allow trusted users/devices onto the network → **How** they connect (wired, wireless, VPN, etc.) ,(via 802.1X, MAC auth, captive portal, etc.) 2. **Access Control & Policy Enforcement** → Grant access based on role, location, device type, or compliance status. 3. **Guest Access Management** → Provide secure and temporary access for visitors. → When they are allowed (time-based access policies) 4. **Endpoint Posture Assessment** → Check if the device is compliant (e.g., antivirus, OS patch) before giving full access. 5. **Device Profiling** → Automatically identify what type of device is connecting (e.g., printer, phone, laptop). 6. **Visibility & Monitoring** → See who and what is on the network in real-time. 7. **Integration with RADIUS / AAA Systems** → Centralized authentication and authorization. 8. **Centralized Management Platform** → One place to configure and monitor access policies. --- ## What Must Be Configured? ### On Enterprise Grade NAC: * An **LDAP connection** to Active Directory: * AD IP or hostname * Base DN (search path) * Bind user credentials * Filters to match users or groups ### On Switch: * RADIUS client settings: * Server IP (NAC) * Shared secret Dot1X / MAC auth settings --- ## Do switches always use RADIUS? ### **No**, switches can use **both RADIUS** and **TACACS+**, but they are used for **different purposes**. Key Difference: | Use Case | Protocol Used | | --- | --- |

User/device authentication (802.1X, MAC auth, Wi-Fi logins, NAC)

RADIUS

Admin access authentication (SSH, Telnet, console login to switch)

TACACS+

A real-world use case of TACACS+ that I personally observed was in an ISP (service provider) environment. It was primarily used for console and SSH access to network devices, where user privileges were controlled based on their assigned privilege levels. The setup and use of TACACS+ can vary depending on the environment—enterprise, data center, and ISP environments often have different requirements and implementations. Commonly used authentication methods: 802.1X and MAC authentication. ### ✅ 1. **MAC (PAP) – For Non-802.1X Devices** * **Devices**: Printers, IP phones, CCTV, older IoT * **How it works**: Switch sends MAC to RADIUS → RADIUS validates → grants access * **NAC Role**: NAC can **profile the device** and assign **limited VLAN** or **guest access** ### ✅ 2. **802.1X (PEAP) – For Employees** * **Devices**: User laptops, domain-joined machines * **How it works**: User enters domain credentials → tunnel created → creds sent to RADIUS * **NAC Role**: NAC applies **user-specific policy**, such as VLAN, ACL, posture-based access ### ✅ 3. **802.1X (EAP-TLS) – For Secure Environments** * **Devices**: Sensitive client devices (finance, healthcare, developers) * **How it works**: Certificate-based auth between client and server → RADIUS validates both * **NAC Role**: NAC can verify **certificate validity**, apply strict policies (e.g., full access only if compliant) Bottom Line: * All these NAC solutions help **secure the network by controlling who/what connects**, ensuring compliance, and providing visibility—all essential for **Zero Trust** and **secure access control** in modern enterprise networks.