Supposed you are the Chief Network Engineer of a certain Telco. Your company is planning for a big business expansion and it requires that your network authenticate users connecting using analog…

TACACS+ is a Cisco-proprietary protocol primarily designed for device administration - authenticating administrators to routers and switches - not for authenticating end-users connecting via analog modems, DSL, or VPN at the network access layer.

DIAMETER is the next-generation successor to RADIUS but is primarily deployed in mobile/LTE carrier-grade and IMS environments, not in traditional multi-technology telco access scenarios involving analog modems and Frame Relay.

Kerberos is a ticket-based authentication protocol designed for enterprise domain authentication (e.g., Active Directory environments) and is not designed for authenticating remote dial-up, DSL, wireless, or VPN users at the network access layer.

RADIUS (Remote Authentication Dial-In User Service) was purpose-built for authenticating users connecting via analog modems, DSL, wireless, and VPN services, operating as a client-server protocol where the Network Access Server acts as the RADIUS client and forwards credentials to the RADIUS server. Its broad support across multi-technology network access scenarios - including Frame Relay-based VPNs - makes it the industry-standard choice for large-scale telco deployments requiring unified AAA. Unlike its alternatives, RADIUS was specifically engineered for dial-in and broadband network access authentication at scale.