This article discusses differences in behavior of SRX when TACACS or RADIUS is used for system accounting. Although the article is focused on the SRX it applies to all Junos platforms.

Different behavior is seen for TACACS and RADIUS in the following scenarios:

• When system accounting is configured on the SRX and a configuration change is made on the device using "load set terminal" command all the configuration statements of this change are sent to the TACACS server.  In the case of Radius, only the "load set terminal" is sent.
• RADIUS Accounting does not work on secondary node in a cluster whereas TACACS accounting works.

On the SRX, accounting for TACACS is handled by ' mgd ' process which accounts for commands getting executed on CLI as well as in background.  Whereas accounting for RADIUS is handled by ' Auditd ' process; this process only does accounting for commands executed on the CLI.

Commands sent to accounting server:

• When RADIUS Server accounting is configured:  Only the " #load set terminal " command is executed on the CLI, thus we will not see all the commands that are executed.
• When TACACS accounting is configured:   we see all the commands that are executed including the commands that are part of  " #load set terminal ".

• Since  Auditd process only runs on the Primary node, RADIUS accounting doesn't work on the Secondary node.
• Whereas mgd runs on both nodes; thus TACACS accounting works on both nodes.

This behavior is as expected and by design.