An Internet Service Provider (ISP) has a need to authenticate users connecting via analog modems, Digital Subscriber Lines (DSL), wireless data services, and Virtual Private Networks (VPN) over a Fram

DIAMETER is the next-generation AAA protocol adopted primarily for mobile carrier (3G/4G/5G) and IMS networks, and is not the conventional solution for the legacy dial-up and DSL ISP access scenario described.

RADIUS (Remote Authentication Dial-In User Service) was originally designed specifically for authenticating dial-up modem users and has since been extended to cover DSL, wireless data services, and VPN access - exactly the technology mix described in the scenario. It operates over UDP with a NAS-client to RADIUS-server model that scales efficiently for the large subscriber bases ISPs manage. Its wide compatibility with legacy and modern access technologies makes it the standard AAA solution in ISP environments.

TACACS+ is designed for device administration and privileged access control on network equipment such as routers and switches, not for authenticating end-user network access connections across diverse ISP access technologies.

Kerberos is a ticket-granting authentication protocol built for enterprise LAN and Active Directory environments, and lacks the NAS integration and network access accounting capabilities required for ISP subscriber authentication.