topic Re: AAA Command Accounting on PIX in Network Access Control

AAA Command Accounting on PIX

bnidacoc — Fri, 21 Feb 2020 17:58:14 GMT

On our routers we can perform user command accounting. For example, we can get a log of the commands users enter in the routers from our ACS box.

I haven't been successful in doing the same on the PIX. Instead, I've gotten all IP and and layer-4 Port accivity in the logs. This is not what I want.

How can I get the accounting feature working to track the configuration changes made on our PIX? Help, URLs would be greatly appreciated.

Thanks

Re: AAA Command Accounting on PIX

mpalardy — Fri, 23 Nov 2001 14:37:16 GMT

Same problem here with PIX's. No way to log accounting with tacacs.

Have you tried Private-I and run the report "PIX configaration changes"

Re: AAA Command Accounting on PIX

bnidacoc — Mon, 26 Nov 2001 15:29:47 GMT

Private-I? I've not heard of that.

I sure wish Cisco would reply to this.

Re: AAA Command Accounting on PIX

k.poplitz — Tue, 27 Nov 2001 22:25:24 GMT

Private I is a great software product published by one of Cisco's partners Open Systems www.opensystems.com. You can download an eval copy from there.

It's functionality and reporting features are far superior to any other product on the market. You should check it out.

Re: AAA Command Accounting on PIX

bnidacoc — Wed, 28 Nov 2001 13:35:21 GMT

Thanks

Looks like a nice product. It may be usefull as a supplimental product to existing.

But it doesn't look like it is going to do tacacs+ accounting of configuration changes, most importantly, WHO has made what changes to the configuration. This is done easily on IOS routers and Ciscosecure ACS and commands for accounting are available on in the PIX OS.

Re: AAA Command Accounting on PIX

gbbromley — Wed, 28 Nov 2001 16:57:22 GMT

Don't know if this would help, however:

"The aaa authentication [serial | telnet | ssh] console command allows you to require authentication verification to access the PIX Firewall unit via serial cable, telnet or ssh. The console options also logs to a syslog server changes made to the configuration."

Never tried it, maybe it will do what you want. I'll give it a try tonight and let you know 😉

Re: AAA Command Accounting on PIX

jekrauss — Wed, 28 Nov 2001 17:20:35 GMT

As the previous poster mentioned, the configuration commands can be viewed in the syslog. The pix does not currently send accounting packets to the ACS server for administration of the pix.

This is scheduled to be implemented in version 6.2, along with command authorization.

HTH

Jeff

Re: AAA Command Accounting on PIX

bnidacoc — Wed, 28 Nov 2001 17:47:40 GMT

Good!!! I can't wait. We were already desiring to go to 6.1.x (?) for the port redirection feature, so this will be an additional reason for an upgrade.

Thanks