e ability to use an external server for authenti- cation, authorization, and accounting. When an external server is used, all user infor- mation is stored externally to the networking device. Administration of user security is therefore centralized. This allows individual users to access many devices, while also allowing the administrator to limit the users' access. RADIUS and TACACS+ are two protocols used for authentication and authorization applications. Each is used to authenticate users, though they can also be used for various other features (logging command usage, call detail records, and SO on). Both are widely used, and at some point, you'll need to decide which one to choose. Here's a quick rundown: RADIUS Livingston Enterprises (now Lucent Technologies) originally developed the Re- mote Authentication Dial-In User Service (RADIUS) for its PortMaster series of network access servers. These devices were widely used by ISPs in the days when 33.6 Kbps modems were the norm. RADIUS was later described in RFCs 2058 and 2059. It is now available in open source server applications. RADIUS includes authentication and authorization in the user profile. RADIUS usually uses UDP ports 1812 or 1645 for authentication, and ports 1813 or 1646 for accounting. TACACS+ The Terminal Access Controller Access-Control System (TACACS) was originally designed for remote authentication of Unix servers. TACACS+, a new Cisco- proprietary protocol that is incompatible with the original version, has since re- placed TACACS. This updated version is widely used for authentication and au- thorization in networking devices. TACACS+ separates the authentication and authorization operations. It is defined in a Cisco RFC draft (http://tools.ietf.org/ html/draft-grant-tacacs-02) and utilizes TCP port 49 by default. Cisco generally recommends TACACS+ over RADIUS, though both are usually avail- able for configuring authentication. One important consideration is that RADIUS does not allow users to limit the commands a user can execute. If you 