topic Re: Command accounting w/ RADIUS in Network Access Control

Command accounting w/ RADIUS

dgroscost — Sun, 10 Mar 2019 23:41:50 GMT

Not having much luck getting this to work and searching the forums here everybody seems to say it is not possible unless TACACS+ is used. Is this still the case? I see the AAA/ACCT/CMD in the debug on the local switch but the RADIUS server never receives the data string except for the authentication entry.

Any way to re-classify the AAA/ACCT/CMDs and send in a syslog trap/log?

Looking for creative solutions here, TACACS+ is not available in this case.

Thanks

Re: Command accounting w/ RADIUS

Jatin Katyal — Tue, 22 Sep 2009 14:42:10 GMT

Hi,

Command accounting only works with tacacs protocol.

It is not supported by radius.

HTH

Regards,

Re: Command accounting w/ RADIUS

Jagdeep Gambhir — Tue, 22 Sep 2009 15:09:50 GMT

Hi,

Unfortunately you can not log any AAA information to syslog.

Now you may ask why IOS CLI allows to configure command accounting via RADIUS when it is not supported. Well, this is indeed an IOS caveat which is described in CSCdp57020 'parser should not show radius as an aaa accounting commands option' and resolved in 12.2 based IOS trains (ref. Bug Toolkit on Cisco.com).

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?caller=pluginredirector&method=fetchBugDetails&bugId=CSCdp57020

Regards,

~JG

Do rate helpful posts