topic Re: Problems with accounting on FWSM in Network Access Control

Problems with accounting on FWSM

antonello.moneta — Sun, 10 Mar 2019 23:56:14 GMT

Hello

I configured aaa on FWSM, it works great expect the accounting for telnet and ssh. This is my configuration

aaa-server tacacs+ protocol tacacs+
aaa-server tacacs+ (inside) host xxxxxxx
key xxxxxxxxxx
aaa-server tacacs+ (inside) host xxxxxxxx
key xxxxxxxxxxxxx
aaa authentication telnet console tacacs+ LOCAL
aaa authentication ssh console tacacs+ LOCAL
aaa authentication enable console tacacs+ LOCAL
aaa accounting telnet console tacacs+
aaa accounting ssh console tacacs+

I am using ACS 4.1, with this config I aspect to see in Report activities -> TACACS+ Accounting a report when I login CLI by telnet or ssh? Is right, or I am wrong?

Can you please help me to find where is my mistake?

Thank you in advice.

Best regards Antonello.

Re: Problems with accounting on FWSM

Ganesh Hariharan — Sun, 07 Feb 2010 14:24:14 GMT

Hello

I configured aaa on FWSM, it works great expect the accounting for telnet and ssh. This is my configuration

I am using ACS 4.1, with this config I aspect to see in Report activities -> TACACS+ Accounting a report when I login CLI by telnet or ssh? Is right, or I am wrong?

Can you please help me to find where is my mistake?

Thank you in advice.

Best regards Antonello.

Hi Antonello,

Configuration are ok Login reports for any configured device in acs will be shown in passed authentication as sucessful authentication and in TACAS accounting only start and stop session for your authentication will be given with session id.

Hope to help

Ganesh.H

Re: Problems with accounting on FWSM

Farrukh Haroon — Sun, 07 Feb 2010 17:45:16 GMT

You might be hitting the following ACS bug, either install the mentioned patch or upgrade your ACS version:

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.1/release/notes/RNacs41.html#wp164275

Please rate if helpful.

Regards

Farrukh

Re: Problems with accounting on FWSM

antonello.moneta — Mon, 08 Feb 2010 08:21:12 GMT

Dear Ganesh and Farrukh, thank you a lot for you help.

What you said Ganesh is exactly what I aspect to see. But when I login in the device I see a Passed Authentication report but nothing in Tacacs Accounting. I tried also to config command accounting and it was working great and I could find reports of commands I typed in TACACS Administration. Anyway for the other devices(routers and switches ) TACACS Accounting is working.

I don't think is also a bug which Farrukh sent. Because is about TACACS Administration logs.

For your experience how can I check if the info are received form ACS? I mean there is like a debug command in ACS? Using debug aaa accounting I see that FWSM is sending info to ACS.

Any other tips and ideas are welcome.

Thank you really much,

Best regards Antonello.

Re: Problems with accounting on FWSM

Jagdeep Gambhir — Mon, 08 Feb 2010 16:20:54 GMT

Hi An,

If accounting is wokring for router and switch then its doesn't look like ACS issue. Run debugs on FWSM,

debug tacacs

debug aaa authentication

debug aaa accounting

Now check if it is sending accounting packets.

Regards,

~JG

Do rate helpful posts

Re: Problems with accounting on FWSM

antonello.moneta — Wed, 10 Feb 2010 16:30:34 GMT

Hi JG,

thanks for your answer.

I already tried

here the result:

XXXXXXXX/admin# debug aaa accounting
XXXXXXXX/admin# start accounting for user: userX, session id: 549453844
stop accounting for user: amoneta, session id: 549453844

I am confiused, because all seems work great except I cannot get the ACS reports accouting.

Thanks a lot for your help.

Best Regards An(I like the way you call me).

Re: Problems with accounting on FWSM

Eli Barb — Wed, 15 Dec 2010 22:22:27 GMT

Have you applied the 'aaa accounting command [tacacs+-server-tag]' command to your configuration.

To send accounting messages to the TACACS+ accounting server when you enter any command other than show commands at the CLI, use the aaa accounting command command in global configuration mode. To disable support for command accounting, use the no form of this command.

Eli