TACACS+ Server
TACACS+ Server for Secure Network Device Administration
Alepo TACACS+ Server is a carrier-grade, enterprise-class solution that centralizes privileged administrative access across your network infrastructure. It authenticates every privileged login, authorizes every command, and records every session, all from a single policy point. NetOps and security teams know exactly who can reach each device and what they are permitted to do on it.
- Per-Command Authorization: Approve or deny each command an administrator runs, by user and by role, from one central policy
- Individual Accountability: Per-user authentication replaces shared device passwords, and every session is recorded and attributable
- Built-In Threat Detection: The Alepo AI Agent analyzes TACACS+ telemetry in real time for brute force, credential stuffing, and privilege escalation
- Deploy Anywhere: Kubernetes, VMs, bare metal, private or public cloud, on premises, or as a fully managed service
Why Network Device Administration Needs a TACACS+ Server
Without a TACACS+ server, device access usually runs on shared local credentials, with the same passwords sitting on hundreds of devices and no per-user accountability.
Individual Accountability
Every administrative action on every device is tied to a named individual. When a configuration changes, you know who, what, where, and when.
Enforced Least Privilege
A NOC operator runs show commands. Only senior engineers touch the running config. Privilege levels are enforced by policy, not left to convention.
Audit Readiness
Per-user access records give security frameworks and regulators the evidence they require, and SIEM and firewall integration ties them into incident workflows.
Platform Consolidation
TACACS+ runs natively on the same Alepo platform that handles RADIUS and Diameter. There is no separate point product to license, patch, and maintain.
What Is a TACACS+ Server?
TACACS+ (Terminal Access Controller Access-Control System Plus) is a protocol built for controlling administrative access to network devices. It belongs to the AAA protocol family, but serves a different purpose than subscriber-facing AAA: RADIUS and Diameter authenticate the subscribers and devices that use the network, while TACACS+ governs the engineers who administer it. A TACACS+ server is the central decision point for that protocol. When an engineer logs in to a router, switch, or firewall, the device forwards the request to the TACACS+ server, which answers three questions. Authentication: is this person who they claim to be? Authorization: which commands may they run on this device? Accounting: what did they do, and when?
How Alepo Secures Device Administration
Alepo delivers TACACS+ device administration through five capabilities, all running natively on one platform.
- Individual Credentials: Every administrator signs in with their own credentials, validated centrally, eliminating shared device passwords across the entire estate
- Existing Identity Stores: Integrates with the LDAP and SQL identity stores you already run, so there is no parallel user database to build or maintain
- Multi-Realm Isolation: Separate teams, regions, and business units stay cleanly partitioned, each with its own administrators and policies
- Per-Command Control: Each command an administrator runs is approved or denied in real time, per user and per role, driven by centrally defined policy
- Role-Based Access: NOC operators, field engineers, and senior administrators each receive exactly the access their role requires
- One Policy Point: When a role changes, one policy update applies everywhere instantly, instead of a device-by-device reconfiguration
- Complete Capture: Every login, session, and authorized command is recorded with user identity and timestamps
- Investigation Ready: Security investigations get a queryable answer to who did what, where, and when
- Compliance Evidence: Per-user records available on demand, instead of a manual log-collection exercise across hundreds of devices
- Real-Time Analysis: The Alepo AI Agent for AAA analyzes TACACS+ logs for unauthorized access, brute-force, and credential-stuffing attempts
- Privilege Escalation Detection: Behavioral threat hunting surfaces anomalous administrator activity before it becomes an incident
- Automated Response: Detections can trigger your SIEM and firewalls automatically
- Built In, Not Bolted On: Part of the Alepo platform, not a separate product to buy and integrate
- Active-Active Geo-Redundancy: Device administration is the tool you need most during an outage, so the TACACS+ service stays available through site failures
- Any Infrastructure: Containers on Kubernetes, VMs, bare metal, private cloud (AWS, Azure, GCP), or on premises
- Fully Managed Option: Run it yourself or have Alepo operate it, with the same capabilities in every deployment model
See Command-Level Control in Action
Watch an administrator session flow end to end: login, per-command authorization, full audit capture, and a flagged privilege-escalation attempt, on your choice of infrastructure.
Why Choose Alepo as Your TACACS+ Server?
20+ years building carrier-grade AAA, 35+ global deployments, and Tier-1 operators in production worldwide. One standards-based, 3GPP-compliant platform for RADIUS, Diameter, and TACACS+, interoperable with any TACACS+-capable device.
Beyond End-of-Life ACS
Cisco Secure ACS has reached end-of-life, and many operators still depend on it or on unsupported DIY daemons. Alepo provides a supported, enterprise-class migration path.
Not a Point Product
Dedicated device-administration tools deliver TACACS+ and nothing else. Alepo delivers the same command-level control as a native protocol on its AAA platform, alongside RADIUS and Diameter.
Intelligence, Not Just Logs
Most TACACS+ servers record what happened. Alepo also tells you what it means, converting device-administration telemetry into live threat detection with automated response triggers.
Carrier-Proven Performance
99.999% availability with active-active geo-redundancy keeps the service reachable through site failures, and horizontal scaling grows capacity with your device fleet.
Alepo TACACS+ Server
Frequently Asked Questions
What is TACACS+ in networking?
TACACS+ (Terminal Access Controller Access-Control System Plus) is a AAA protocol that controls administrative access to network devices. When an engineer logs in to a router, switch, or firewall, the device forwards the request to a TACACS+ server.
The server then does three things: it authenticates the user, authorizes the commands they may run, and records everything they do. That combination is what turns device access from a shared-password free-for-all into something you can govern and audit.
The server then does three things: it authenticates the user, authorizes the commands they may run, and records everything they do. That combination is what turns device access from a shared-password free-for-all into something you can govern and audit.
What is the difference between TACACS+ and RADIUS?
The short answer is that they solve different problems, and most networks need both.
TACACS+ is designed for device administration. It runs over TCP on port 49, encrypts the full packet payload, separates authentication from authorization, and supports per-command control.
RADIUS is designed for network access. It runs over UDP, encrypts only the password field, and combines authentication with authorization.
TACACS+ governs the engineers who manage the network; RADIUS handles the subscribers and devices that use it. Alepo runs both natively on one platform.
TACACS+ is designed for device administration. It runs over TCP on port 49, encrypts the full packet payload, separates authentication from authorization, and supports per-command control.
RADIUS is designed for network access. It runs over UDP, encrypts only the password field, and combines authentication with authorization.
TACACS+ governs the engineers who manage the network; RADIUS handles the subscribers and devices that use it. Alepo runs both natively on one platform.
Why use TACACS+ instead of local device accounts?
Local accounts mean shared passwords replicated across hundreds of devices, no per-user accountability, and slow offboarding. When someone leaves, you are chasing credentials device by device.
A TACACS+ server centralizes identity, enforces least-privilege command control, and records a complete audit trail. A credential change or a departure is handled once, centrally, rather than device by device.
A TACACS+ server centralizes identity, enforces least-privilege command control, and records a complete audit trail. A credential change or a departure is handled once, centrally, rather than device by device.
Can Alepo replace Cisco Secure ACS?
Yes. Cisco Secure ACS has reached end-of-life, and many operators are still running it or a DIY daemon with no vendor support behind it.
Alepo provides a supported, enterprise-class replacement for TACACS+ device administration, with a migration path that does not require adopting a broader access-control suite or moving into a new vendor ecosystem.
Alepo provides a supported, enterprise-class replacement for TACACS+ device administration, with a migration path that does not require adopting a broader access-control suite or moving into a new vendor ecosystem.
Which devices work with Alepo TACACS+?
TACACS+ is standards-based, so Alepo works with any TACACS+ capable device: routers, switches, firewalls, BNG/BRAS, and wireless controllers.
The platform already integrates with WLC/AP vendors including Cisco, Aruba, Ruckus, Huawei, and Mikrotik, and with BNG/BRAS platforms from Cisco, Nokia, and Juniper.
The platform already integrates with WLC/AP vendors including Cisco, Aruba, Ruckus, Huawei, and Mikrotik, and with BNG/BRAS platforms from Cisco, Nokia, and Juniper.
How is Alepo TACACS+ deployed?
As containers on Kubernetes, on VMs, on bare metal, in private cloud (AWS, Azure, GCP), on premises, or as a fully managed service operated by Alepo.
Every deployment model supports active-active geo-redundant configurations for high availability, which matters more here than elsewhere, because device administration is the tool you need most during an outage.
Every deployment model supports active-active geo-redundant configurations for high availability, which matters more here than elsewhere, because device administration is the tool you need most during an outage.
