https://community.cisco.com/t5/network-access-control/profiler-feed-service-which-node- downloads/td-p/3063261

https://www.cisco.com/c/en/us/td/docs/security/ise/1-3/admin_guide/b_ise_admin_guide_13
/b_ise_admin_guide_sample_chapter_010000.html

One key difference between RADIUS and TACACS+ lies in their encryption mechanisms and the scope of their encrypted data:
RADIUS:
Encrypts only the password field in the packet.

The rest of the packet, including attributes such as usernames, accounting information, and

authorization data, is sent in cleartext.
Uses UDP ports 1812 for authentication and 1813 for accounting (originally 1645 and 1646 for

older implementations).
Primarily focuses on authentication and accounting, with limited control over authorization.

TACACS+:
Encrypts the entire packet (except the header), ensuring that all sensitive data, including

usernames and accounting information, is secure.
Uses TCP port 49, which provides reliable transmission and ensures packet delivery.

Separates authentication, authorization, and accounting (AAA) functions, offering granular

control over each phase.