What is an advantage of TACACS+ versus RADIUS authentication when reviewing reports in Cisco ISE?

The primary advantage of TACACS+ for reporting in Cisco ISE is its separation of Authentication, Authorization, and Accounting (AAA). This architectural difference allows TACACS+ to provide granular command accounting, logging every command an administrator executes on a network device. This detailed information is invaluable for security audits and operational troubleshooting within ISE reports. In contrast, RADIUS combines authentication and authorization processes and its accounting is typically session-based (e.g., session start/stop times, data transferred), lacking the command-level detail that TACACS+ provides.

A: TACACS+ uses connection-oriented TCP, which can introduce more latency for initial setup than the connectionless UDP used by RADIUS. B: TACACS+ encrypts the entire packet payload using a shared secret, not IPsec. RADIUS does not use DTLS for encryption. D: TACACS+ uses a shared secret for encryption, not SSL certificates. RADIUS does encrypt the password attribute, so the claim it has no encryption is false. ---

1. Cisco Identity Services Engine Administrator Guide

Release 3.1

"Device Administration with TACACS+

" section: "TACACS+ Protocol."

This guide states

"TACACS+ provides three services: Authentication

Authorization

and Accounting (AAA). ... TACACS+ accounting provides information about the commands that users are running and the duration of the session." This confirms the command accounting capability central to the correct answer.

2. McNamara

K.

& Woland

A. (2020). CCNP Security Identity Management SISE 300-715 Official Cert Guide. Cisco Press.

Chapter 1

"Fundamentals of Cisco ISE

" page 11

section: "RADIUS Versus TACACS+."

The text explicitly states: "TACACS+ separates the AAA functions... This separation of functions allows for more granular control... For example

with TACACS+

you can authorize a user to run specific commands on a router and then account for each of those commands individually." This directly supports option C as the key advantage.

3. Cisco. (2018). Comparing TACACS+ and RADIUS. Cisco Technical Support & Documentation.

In the comparison table

it highlights that for Accounting

TACACS+ provides "Extensive accounting capabilities (can account for commands)

" whereas RADIUS has "Less extensive accounting capabilities." This document reinforces the superior accounting and reporting features of TACACS+.