Content

| 9.7 |  | Authentication, Authorization, and Accounting |
| 9.7.9 |  | Configuring AAA accounting |

Like authentication and authorization method lists, method lists for accounting define the way accounting will be performed and the sequence in which these methods are performed.

Named accounting method lists are used to designate a particular security protocol to be used on specific lines or interfaces for accounting services. The default method list is automatically applied to all interfaces except those that have a named method list explicitly defined. As with AAA authentication and authorization, a defined method list overrides the default method list.

Accounting method lists are specific to the type of accounting being requested. AAA supports six different types of accounting:

- Network – Provides information for all PPP, SLIP, or ARAP sessions, including packet and byte counts.
- EXEC – Provides information about user EXEC terminal sessions of the network access server.
- Commands – Provides information about the EXEC mode commands that a user issues. Command accounting generates accounting records for all EXEC mode commands, including global configuration commands, associated with a specific privilege level.
- Connection – Provides information about all outbound connections made from the network access server, such as Telnet, local-area transport (LAT), TN3270, packet assembler/disassembler (PAD), and rlogin.
- System – Provides information about system-level events.
- Resource – Provides "start" and "stop" records for calls that have passed user authentication, and provides "stop" records for calls that fail to authenticate.

To configure AAA accounting, issue the aaa accounting command. When using this command, specify which type of accounting to configure. Figure lists some of the keywords associated with the aaa accounting command.

Once an accounting type has been specified, define either a default method list or a named method list. Named method lists must be applied to a specific interface before any of the defined authorization methods will be performed. The default method list is automatically applied to all lines and interfaces if no other method list is defined.

Note that system accounting does not support named method lists.

After specifying a named or default list, indicate the accounting record type. There are four accounting record types:

- none
- start-stop
- stop-only
- wait-start

For minimal accounting, use the stop-only keyword, which instructs the specified method (RADIUS or TACACS+) to send a stop record accounting notice at the end of the requested user process. For more accounting information, use the start-stop keyword to send a start accounting notice at the beginning of the requested event and a stop accounting notice at the end of the event. As in start-stop, wait-start sends both a start and a stop accounting record to the accounting server. However, if the wait-start keyword is used, the requested user service does not begin until the start accounting record is acknowledged. A stop accounting record is also sent.

To stop all accounting activities on this line or interface, use the none keyword.

Finally, after specifying the accounting type, and the accounting record type, configure the accounting method. Accounting methods and their IOS keywords are listed in Figure .

Before configuring AAA accounting, first perform the following tasks:

- Enable AAA using the aaa new-model command.
- Configure the router as a TACACS+ or RADIUS client. This is required for AAA accounting. A server is needed to act as repository for the accounting data.

Figure shows a possible AAA accounting configuration.

The aaa accounting network command enables accounting for network service, which includes information for all PPP, SLIP, or ARAP sessions, including packet and byte counts.

As configured in Figure , RTA will send accounting information for PPP sessions to a TACACS+ server. The format of the output stored on the server varies depending on the TACACS+ or RADIUS implementation. Figure presents sample TACACS+ output from a UNIX TACACS+ daemon.