Configuring AAA Accounting
Enabling AAA accounting feature of AAA helps you log user activity, including network resource utilization, which could be used for billing and auditing. Like authentication and authorization, the
AAA accounting feature has method lists. The two methods used by the AAA accounting feature are RADIUS and TACACS+.
The following six types of accounting can be configured on the Cisco IOS Software:
■ Network—Provides information for all PPP, SLIP, or ARAP sessions, including packet and byte counts.
■ EXEC—Provides information about user EXEC terminal sessions of the NAS.
■ Commands—Provides information about the EXEC mode commands that a user issues. Command accounting generates accounting records for all EXEC mode commands, including global configuration commands, associated with a specific privilege level.
■ Connection—Provides information about all outbound connections made from the NAS, such as telnet.
■ System—Provides information about system-level events.
■ Resource—Provides start and stop records for calls that have passed user authentication, and provides stop records for calls that fail to authenticate.
The syntax for the aaa accounting command is as follows:
aaa accounting {auth-proxy | system | network | exec | connection | commands level} {default | list-name} {start-stop | stop-only | none} [broadcast] group groupname
Table 7-6 explains the keywords and arguments for the aaa accounting command.
|
Keywords |
Description |
|
auth-proxy |
Provides information about all authenticated proxy user events. |
|
system |
Performs accounting for all system-level events not associated with users, such as reloads. |
|
network |
Runs accounting for all network-related service requests, including SLIP, PPP NCPs, and ARAP. |
|
exec |
Runs accounting for EXEC shell session. This keyword might return user profile information such as what is generated by the autocommand command. |
|
connection |
Provides information about all outbound connections made from the NAS, such as telnet, LAT, TN3270, PAD, and rlogin. |
|
commands level |
Runs accounting for all commands at the specified privilege level. Valid privilege level entries are integers from 0 through 15. |
|
Default |
Uses the listed accounting methods that follow this argument as the default list of methods for accounting services. |
|
list-name |
Character string used to name the list of at least one of the accounting methods. |
|
start-stop |
Sends a "start" accounting notice at the beginning of a process and a "stop" accounting notice at the end of a process. |
|
stop-only |
Sends a "stop" accounting notice at the end of the requested user process. |
|
none |
Disables accounting services on this line or interface. |
|
broadcast |
(Optional) Enables sending accounting records to multiple AAA servers. Simultaneously sends accounting records to the first server in each group. If the first server is unavailable, failover occurs using the backup servers defined within that group. |
|
group groupname |
radius or tacacs+. |
The following example shows aaa accounting configuration for users accessing the NAS via PPP.
Router(config)#aaa new-model
Router(config)#aaa authentication login neteng group radius local
Router(config)#aaa authentication ppp default group radius local
Router(config)#aaa authorization exec neteng group radius
Router(config)#aaa authorization network neteng group radius
Router(config)#aaa accounting exec neteng start-stop group radius
Router(config)#aaa accounting network neteng start-stop group radius
Continue reading here: Configuring Tacacs on Cisco IOS
Was this article helpful?