topic Re: Radius and Tacacs at c9800 in Wireless

Radius and Tacacs at c9800

Leftz — Wed, 18 Jan 2023 22:45:27 GMT

Hello, I have a question on below document/link, which is talking about setup RADIUS and TACACS+ at wlc 9800. Both Radius and Tacacs has very similar configuration at c9800. The question is why it use both Radius and Tacacs at C9800 at the same time, or it just talk about two ways for us to choose one of the two? Is there a big difference of the two for c9800? Thanks

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/214490-configure-radius-and-tacacs-for-gui-and.html

Re: Radius and Tacacs at c9800

balaji.bandi — Wed, 18 Jan 2023 22:56:03 GMT

Most cases

TACACS for device management ( to manage device administration using ISE Local database / AD)

Radius for WIFI client authentication. (this can be AD / or any other source)

Re: Radius and Tacacs at c9800

MHM Cisco World — Thu, 19 Jan 2023 00:20:30 GMT

tacacs vs radius
radius merge the auth and authz in same packet
tacacs use separate,
so I think that tacacs is more better use than radius for any CoA or command restrict.

Re: Radius and Tacacs at c9800

Leftz — Thu, 19 Jan 2023 17:19:44 GMT

Thank all you for your reply!

@balaji.bandi Can I say we can use both Radius and TACACS+ for one c9800 or just choose one of both?

Re: Radius and Tacacs at c9800

balaji.bandi — Thu, 19 Jan 2023 18:50:21 GMT

Mixing is not good, my suggestion always use TACACS for device authentication.