# Network device administration with TACACS+

> No more shared admin passwords on switches, routers and firewalls. Radiator provides TACACS+ and RADIUS device administration tied to your directory groups, with per-command authorisation, multi-factor on privileged access and an accounting trail your assessor will accept.

Source: https://level9.net/radiator/solutions/device-administration
Publisher: Level9 Networks (https://level9.net)
Updated: 2026-11-03

**Who it is for.** Network operations and security teams in enterprises, public bodies and service providers running multi-vendor networks.

**The problem.** Shared local accounts on network devices cannot be audited and cannot be revoked when people leave. Vendor-specific tools cover one estate and leave the rest.

**Target outcome.** Every administrative session on every device is tied to a named person, authorised command by command where needed, and recorded.

## Measures

- Devices using central authentication rather than local accounts
- Privileged sessions with a second factor
- Time to revoke access for a leaver

Protocols: TACACS+, RADIUS

## The outcome

Engineers log in to any device with their own account. Their role decides what they can do. Privileged access needs a second factor. Every session and command is recorded centrally, and when someone leaves, disabling one account disables their access everywhere.

## How it works

Devices send authentication, authorisation and accounting to Radiator over TACACS+ or RADIUS, with TACACS+ over TLS available in Radiator Policy Server. Radiator checks credentials against Active Directory, Entra ID or LDAP, maps group membership to a role, and returns the privilege level or command authorisation. Accounting records go to your logging platform for audit.

## What Level9 does

We design the role model with your team, configure Radiator, integrate the directory and multi-factor service, and migrate device configuration in stages. We support the platform in the UK afterwards.

## Products

[Radiator AAA Server](/radiator/products/radiator-aaa-server) or [Radiator Policy Server](/radiator/products/radiator-policy-server).

## Questions people ask

**Does Radiator support TACACS+ command authorisation?**

Yes. Radiator can authorise individual commands based on the user's role, so a first-line engineer can run show commands while configuration changes require a higher role.

**Can we use it with Cisco, Juniper, Arista, Fortinet and others?**

Yes. TACACS+ and RADIUS are standard on network equipment from every major vendor, and Radiator is vendor-neutral.

**Can it replace Cisco ISE for device administration?**

Yes. Device administration is a common reason to move to Radiator, and we migrate the role model as part of the project.

---
Level9 Networks is an authorised UK partner of Radiator Software Oy. Radiator is a trademark of Radiator Software Oy. Level9 Networks Limited, United Kingdom.