diff --git a/data/templates/tacplus_nss.conf.j2 b/data/templates/tacplus_nss.conf.j2
index 812b47bf..909c1616 100644
--- a/data/templates/tacplus_nss.conf.j2
+++ b/data/templates/tacplus_nss.conf.j2
@@ -34,6 +34,13 @@ local_authorization
 {% if tacacs_authorization %}
 tacacs_authorization
 {% endif %}
+{% if tacacs_authorization and traceid_authorization %}
+
+# traceid_authorization - If you want to send SSH TraceId in TACACS+ authorization, set it
+# Default: on
+# traceid_authorization
+traceid_authorization
+{% endif %}
 
 # src_ip - set source address of TACACS+ protocol packets
 # Default: None (auto source ip address)
diff --git a/scripts/hostcfgd b/scripts/hostcfgd
index d55f1811..1a3726fc 100644
--- a/scripts/hostcfgd
+++ b/scripts/hostcfgd
@@ -87,6 +87,7 @@ LIMITS_CONF = "/etc/security/limits.conf"
 TACPLUS_SERVER_PASSKEY_DEFAULT = ""
 TACPLUS_SERVER_TIMEOUT_DEFAULT = "5"
 TACPLUS_SERVER_AUTH_TYPE_DEFAULT = "pap"
+TACPLUS_TRACEID_AUTHORIZATION_DEFAULT = True
 
 # RADIUS
 RADIUS_SERVER_AUTH_PORT_DEFAULT = "1812"
@@ -366,7 +367,8 @@ class AaaCfg(object):
         self.tacplus_global_default = {
             'auth_type': TACPLUS_SERVER_AUTH_TYPE_DEFAULT,
             'timeout': TACPLUS_SERVER_TIMEOUT_DEFAULT,
-            'passkey': TACPLUS_SERVER_PASSKEY_DEFAULT
+            'passkey': TACPLUS_SERVER_PASSKEY_DEFAULT,
+            'traceid_authorization': TACPLUS_TRACEID_AUTHORIZATION_DEFAULT
         }
         self.tacplus_global = {}
         self.tacplus_servers = {}
@@ -467,6 +469,8 @@ class AaaCfg(object):
     def tacacs_global_update(self, key, data, modify_conf=True):
         if key == 'global':
             self.tacplus_global = data
+            if 'traceid_authorization' in self.tacplus_global:
+                self.tacplus_global['traceid_authorization'] = is_true(self.tacplus_global['traceid_authorization'])
             if modify_conf:
                 self.modify_conf_file()
 
@@ -808,7 +812,8 @@ class AaaCfg(object):
                                         local_accounting=local_accounting_conf,
                                         tacacs_accounting=tacacs_accounting_conf,
                                         local_authorization=local_authorization_conf,
-                                        tacacs_authorization=tacacs_authorization_conf)
+                                        tacacs_authorization=tacacs_authorization_conf,
+                                        traceid_authorization=tacplus_global['traceid_authorization'])
         with open(NSS_TACPLUS_CONF, 'w') as f:
             f.write(nss_tacplus_conf)
 
diff --git a/tests/hostcfgd/hostcfgd_tacacs_test.py b/tests/hostcfgd/hostcfgd_tacacs_test.py
index c07b961c..fbafd746 100644
--- a/tests/hostcfgd/hostcfgd_tacacs_test.py
+++ b/tests/hostcfgd/hostcfgd_tacacs_test.py
@@ -38,7 +38,7 @@ class TestHostcfgdTACACS(TestCase):
         Test hostcfd daemon - TACACS
     """
     def run_diff(self, file1, file2):
-        _, output = getstatusoutput_noshell(['diff', '-uR', file1, file2])
+        _, output = getstatusoutput_noshell(['diff', '-ur', file1, file2])
         return output
 
     """
diff --git a/tests/hostcfgd/sample_output/TACACS_config_db_local_and_tacacs/tacplus_nss.conf b/tests/hostcfgd/sample_output/TACACS_config_db_local_and_tacacs/tacplus_nss.conf
index 431cbcec..2c6ab5ea 100644
--- a/tests/hostcfgd/sample_output/TACACS_config_db_local_and_tacacs/tacplus_nss.conf
+++ b/tests/hostcfgd/sample_output/TACACS_config_db_local_and_tacacs/tacplus_nss.conf
@@ -24,6 +24,11 @@ local_authorization
 # tacacs_authorization
 tacacs_authorization
 
+# traceid_authorization - If you want to send SSH TraceId in TACACS+ authorization, set it
+# Default: on
+# traceid_authorization
+traceid_authorization
+
 # src_ip - set source address of TACACS+ protocol packets
 # Default: None (auto source ip address)
 # src_ip=2.2.2.2
diff --git a/tests/hostcfgd/test_tacacs_vectors.py b/tests/hostcfgd/test_tacacs_vectors.py
index a6938eb6..3fab97e1 100644
--- a/tests/hostcfgd/test_tacacs_vectors.py
+++ b/tests/hostcfgd/test_tacacs_vectors.py
@@ -47,7 +47,8 @@
                             "auth_type": "chap",
                             "timeout": 5,
                             "passkey": "dellsonic",
-                            "src_intf": "Ethernet0"
+                            "src_intf": "Ethernet0",
+                            "traceid_authorization": "false"
                     }
                 },
                 "TACPLUS_SERVER": {
@@ -109,7 +110,8 @@
                             "auth_type": "chap",
                             "timeout": 5,
                             "passkey": "dellsonic",
-                            "src_intf": "Ethernet0"
+                                "src_intf": "Ethernet0",
+                                "traceid_authorization": "false"
                     }
                 },
                 "TACPLUS_SERVER": {