TACACS needs NTP sync to work correctly, but the requirement depends on how strict your network's security settings are

TACACS+ (Terminal Access Controller Access-Control System Plus) is a protocol that controls who can log into network devices like routers and switches. It works by checking a username and password against a central server. When TACACS+ and the devices it protects have clocks that drift apart, authentication can fail silently — the server rejects the login, but the error message doesn't always tell you why.

The core issue is that TACACS+ uses timestamps to prevent replay attacks, where someone intercepts a valid login and uses it again later. If your TACACS server's clock is 5 minutes ahead of a network device's clock, the device will reject the authentication response as too old, even though the server just sent it. NTP (Network Time Protocol) keeps all clocks synchronized so this doesn't happen.

Key Takeaways

  • TACACS+ can function without NTP, but authentication will fail if server and device clocks drift more than a few minutes apart.
  • NTP synchronization prevents replay attacks by ensuring timestamps on authentication packets are trusted across your network.
  • Most TACACS implementations use a default time window of 5 minutes, meaning clocks can drift that far before logins start failing.
  • Setting up NTP on your TACACS server and all network devices takes one configuration step per device and prevents hard-to-diagnose authentication outages.

How TACACS+ uses timestamps to verify logins

When you log into a network device, TACACS+ doesn't just check your password. It also checks the timestamp on the authentication packet to make sure the packet was created recently, not captured and replayed hours or days later. This timestamp is generated by the TACACS server and verified by the network device.

If the device's clock is significantly behind the server's clock, the device will see the timestamp as coming from the future and reject it. If the device's clock is ahead, it will see the timestamp as too old. Either way, the login fails. The device doesn't usually tell you "your clock is wrong" — it just says authentication failed, which sends you looking in the wrong places.

The default time window and when drift becomes a problem

Most TACACS+ implementations allow a time window of 5 minutes between the server's clock and the device's clock. This means if your server is 4 minutes and 59 seconds ahead or behind, authentication still works. At 5 minutes and 1 second, it stops.

In a small network with few devices, clock drift happens slowly. A device might lose 30 seconds per month, so you could go months before hitting the 5-minute threshold. In larger networks with many devices, or in environments where devices are rebooted frequently, clocks can drift faster. Once one device's clock drifts too far, that device can no longer authenticate to the TACACS server, and you lose remote access to it.

Setting up NTP on TACACS servers and network devices

NTP synchronizes clocks by connecting to a time source — usually a public NTP server on the internet, or a local NTP server in your data center. The TACACS server should point to the same NTP source as all your network devices, so they all stay within a few milliseconds of each other.

On a TACACS server running Linux, you typically install and enable the NTP daemon (ntpd) or chrony, then point it to a public server like 0.pool.ntp.org or 1.pool.ntp.org. On network devices like Cisco routers, you configure NTP with a command like ntp server 10.0.0.1 (if 10.0.0.1 is your internal NTP server) or ntp server 0.pool.ntp.org for a public server. Most devices sync within a few minutes of startup.

If you don't have internet access from your network devices, you can set up a local NTP server in your data center and point all devices to it. This is common in air-gapped or highly restricted networks.

What happens if you skip NTP

TACACS+ will work fine for a while. Authentication will succeed as long as clocks stay within the time window. But as clocks drift, you'll eventually hit a point where one or more devices can no longer reach the TACACS server. Remote access to those devices fails, and you have to fix the clock manually or use an out-of-band connection (like a console cable) to get back in.

The problem is hardest to diagnose because the error message is usually just "authentication failed" — it doesn't say "your clock is 6 minutes off." You might spend time checking passwords, network connectivity, and TACACS server logs before realizing the issue is time synchronization.

Checking if your clocks are already in sync

On a Linux TACACS server, run date to see the current time. On a Cisco device, run show clock. Compare the times across your server and a few devices. If they're within a few seconds, you're fine for now. If they're minutes apart, set up NTP before you hit the 5-minute threshold.

You can also check whether NTP is already running. On Linux, run ntpq -p to see if ntpd is synced. On a Cisco device, run show ntp status. If NTP is not running or not synced, the device's clock will drift over time.

TACACS+ and other authentication protocols with time requirements

TACACS+ is not alone in needing accurate time. RADIUS, another common authentication protocol, also uses timestamps and can fail if clocks drift too far. Two-factor authentication methods like TOTP (Time-based One-Time Password) are even more sensitive — they generate a new code every 30 seconds, so a clock that's off by more than 30 seconds will cause codes to fail.

If you're running any of these systems, NTP is not optional. It's a foundational part of network infrastructure, like DNS or DHCP. Once it's set up, it runs in the background and requires almost no maintenance.

Frequently Asked Questions

Can I use a manual time sync instead of NTP?

You can manually set the time on each device, but you'll have to do it again every few weeks or months as clocks drift. NTP is automatic and continuous, so it's the only practical solution for networks with more than a few devices.

What if my network has no internet access?

Set up a local NTP server in your data center or on a device with a GPS receiver. All other devices point to that local server. This is common in air-gapped networks and works just as well as pointing to a public NTP server.

Will TACACS work if the time is off by just a minute or two?

Yes. Most implementations allow up to 5 minutes of drift. A minute or two is well within the safe range. But clocks drift continuously, so a device that's 2 minutes off today will be 5 minutes off in a few weeks.

How do I know if a login failed because of time sync?

Check the TACACS server logs and compare the server's clock to the device's clock. If they're more than a few minutes apart, time sync is the problem. The server logs may also show timestamp validation errors if you enable debug logging.

Do I need NTP if I only have one TACACS server and one device?

Even with one device, NTP prevents the clock drift problem from happening in the first place. Without it, you'll eventually hit the 5-minute threshold and lose access. NTP takes minutes to set up and runs automatically, so it's worth doing even for small networks.