An Internet Service Provider (ISP) has a need to authenticate users connecting via analog modems, Digital Subscriber Lines (DSL), wireless data services, and Virtual Private Networks (VPN) over a Fram

DIAMETER is RADIUS's successor but is primarily deployed in mobile carrier core networks (3GPP/LTE) rather than traditional ISP multi-access environments built on Frame Relay infrastructure.

RADIUS (Remote Authentication Dial-In User Service) was specifically designed for ISP network access scenarios and integrates natively with Network Access Servers (NAS) deployed over infrastructure such as Frame Relay. It supports authentication for analog modems, DSL, wireless data services, and VPN tunnels through a common AAA framework, making it the de facto standard for subscriber access management. Its widespread NAS client support and UDP-based transport make it operationally suited for high-volume ISP subscriber environments.

TACACS+ is designed for administrative authentication to network devices such as routers and switches, not for authenticating end-user subscriber connections across heterogeneous access technologies.

Kerberos is a ticket-based protocol designed for enterprise LAN single sign-on and does not natively support network access authentication for ISP subscribers connecting via modem, DSL, or VPN.