Port reference
Port 49 (TCP) – TACACS+
TACACS+ — Cisco's AAA protocol that authenticates and authorizes administrative access to network devices.
Quick facts
- Transport
- tcp
- Category
- Well-known
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on TACACS+ servers (ISE, ACS, tac_plus). Should be reachable only from managed network devices, never the internet.
What is port 49 used for?
Port 49 carries TACACS+, Cisco's protocol for AAA (authentication, authorization,
and accounting) on network devices. When an administrator logs into a router,
switch, or firewall, the device checks the login and each command against a
TACACS+ server over port 49. Common server software includes Cisco ISE, the older
Cisco ACS, and the open-source tac_plus daemon. It is widely used to centrally
manage who can administer network gear.
When would you open it?
Open port 49 on the TACACS+ server so your managed routers, switches, and firewalls can reach it for login and command authorization. Keep it reachable only from those devices on a management network. Only open it if you actually run a TACACS+ server for centralized device administration.
Is it safe to open?
Its shared-secret encryption is weak, so use a long unique secret per device, keep the server private to management VLANs, and never expose it to the internet. See the security notes below.
How to check if this port is open
ss -tulpn | grep :49
nmap -p 49 <target>netstat -ano | findstr :49
Test-NetConnection <host> -Port 49lsof -i :49
nmap -p 49 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 49 to your device's local IP, internal port 49, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 49/tcpsudo firewall-cmd --permanent --add-port=49/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 49 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 49" -Direction Inbound -Protocol TCP -LocalPort 49 -Action AllowSecurity & risks
Common attacks
- Shared-secret cracking from captured TACACS+ traffic
- Body decryption exposing usernames, commands, and authorization data
- Man-in-the-middle interception of device administration sessions
- Replay and brute-force of administrator logins
Hardening
- Use a long, random shared secret per device, not a global one
- Restrict TCP 49 to management VLANs and AAA servers only
- Tunnel TACACS+ over IPsec where the network is untrusted
- Enable command accounting and alert on failed administrative logins
- Patch the AAA server (ISE/ACS) and rotate secrets regularly
How to block this port
sudo ufw deny 49/tcpsudo firewall-cmd --permanent --remove-port=49/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 49 -j DROPNew-NetFirewallRule -DisplayName "Block 49" -Direction Inbound -Protocol TCP -LocalPort 49 -Action Blocknmap snippet
nmap -p49 --script banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is port 49 used for?
- Port 49 is TACACS+, Cisco's AAA protocol that authenticates administrators logging into routers, switches, and firewalls and authorizes the commands they can run.
- Is TACACS+ traffic encrypted?
- TACACS+ encrypts the packet body with the shared secret, but the design is cryptographically weak. A captured session can be decrypted offline if the secret is guessed.