Cisco ACS is a tried and true solution for centralized router and switch authentication. I would install one TACACS server as your primary and replicate it to a secondary. I would do this with virtual machines for ease of maintenance and support. As to whether or not you install a TACACS solution on each continent you support, you could justify this depending upon how many devices there are in each part of the world. Hope this helps you make an informed decision: "With the Base license, a Cisco Secure ACS 5.5 appliance or software virtual machine can support the deployment of up to 500 network devices. These are authentication, authorization, and accounting (AAA) clients. The number of network devices is based on how many unique IP addresses are configured. The 500-device limit is not a limit for each individual appliance or instance, but a deployment-wide limit that applies to a set of Cisco Secure ACS instances (primary and secondary) that are configured for replication." -Paul ... View more