ailable in open source server applications. RADIUS includes authentication and authorization in the user profile. RADIUS usually uses UDP ports 1812 or 1645 for authentication, and ports 1813 or 1646 for accounting. TACACS+ The Terminal Access Controller Access-Control System (TACACS) was origi- nally designed for remote authentication of Unix servers. TACACS+, a new Cisco-proprietary protocol that is incompatible with the original version, has since replaced TACACS. This updated version is widely used for authentication and authorization in networking devices. TACACS+ separates authentication and authorization into separate operations. It is defined in a Cisco RFC draft (http:// tools.ietf.org/html/draft-grant-tacacs-02) and utilizes TCP port 49 by default. Cisco generally recommends TACACS+ over RADIUS, though both are usually available when configuring authentication. One important consideration is that RADIUS does not allow users to limit the commands a user can execute. If you need this feature, choose TACACS+. For more information on the differences between TACACS+ and RADIUS, see Cisco's document ID 13838 (http://www.cisco.com/ warp/public/480/10.html). Chapter 24: Authentication in Cisco Devices To use a security server, you must configure server groups. Server groups are logical groups of servers that can be referenced with a single name. You can use default server groups, or create your own custom groups. Default RADIUS and TACACS+ server groups In a Cisco environment using ACS (Cisco's security authentication and authoriza- tion management system), TACACS+ is used. RADIUS is also supported if ACS or TACACS+ is not available. TACACS+ servers are defined globally in a router using the tacacs-server command. Defining where to find a TACACS+ server is done with the host keyword: tacacs-server host 10.100.100.100 A hostname can be used, provided that you have configured DNS on the router. You can also list multiple servers, in which case they will be referenced in the order in which they appear: tacacs-serv