Question

A network engineer must deploy AAA on a fleet of Catalyst switches with the following requirements: administrators must be authorized on a per-command basis, each command executed must be logged for audit, and the entire packet payload between the switch and the AAA server must be encrypted. Which protocol should be configured to meet ALL of these requirements?

Accepted Answer

TACACS+, because it supports per-command authorization and encrypts the full packet body

Answer

RADIUS, because it encrypts the entire packet and supports command accounting natively

Answer

Local AAA with privilege levels, because it provides granular per-command control without a server

Answer

RADIUS with CoA, because Change of Authorization enables per-command authorization enforcement