topic Re: Command accounting with ACS in Network Access Control

Command accounting with ACS

jain.nitin — Sun, 10 Mar 2019 23:34:52 GMT

HOw can I achive command accounting via acs I have configured devices as below but no luck

aaa accounting exec aaa-list start-stop group bwaaa

aaa accounting commands 1 aaa-list start-stop group bwaaa

aaa accounting commands 15 aaa-list start-stop group bwaaa

aaa accounting system default start-stop group bwaaa

any idea about it

Re: Command accounting with ACS

Jagdeep Gambhir — Wed, 08 Jul 2009 17:12:43 GMT

Hi,

Command accounting only works with tacacs and not with radius. Make sure bwaaa is set up as tacacs.

These logs are stored in tacacs administration report, so make sure you are checking the correct head.

Still it is not working then check acs code. Incase it is 4.1.1 then you need to apply patch 5 to fix it.

To download patch for appliance,

http://www.cisco.com/cgi-bin/tablebuild.pl/acs-soleng-3des

For windows

http://www.cisco.com/cgi-bin/tablebuild.pl/acs-win-3des

Regards,

~JG

Do rate helpful posts

Re: Command accounting with ACS

jain.nitin — Wed, 08 Jul 2009 17:51:18 GMT

Hi, I am using 4.2 version appliance. I am using tacacs+ u can s below config for your reference

aaa new-model

aaa group server tacacs+ bwaaa

server 10.2.6.1

server 10.2.6.2

ip tacacs source-interface Vlan1111

aaa authentication login aaa-list group bwaaa local

aaa authentication enable default group bwaaa enable

aaa authorization exec aaa-list group bwaaa local

aaa accounting exec aaa-list start-stop group bwaaa

aaa accounting commands 1 aaa-list start-stop group bwaaa

aaa accounting commands 15 aaa-list start-stop group bwaaa

aaa accounting system default start-stop group bwaaa

aaa session-id common

tacacs-server host 10.2.6.1 timeout 25

tacacs-server host 10.2.6.2 timeout 25

tacacs-server timeout 25

tacacs-server directed-request

tacacs-server key cisco123

Re: Command accounting with ACS

Jagdeep Gambhir — Wed, 08 Jul 2009 19:06:38 GMT

As stated in other post, try it without any method list and get the debugs

debug aaa accounting

debug tacacs

Did you check tacacs administration logs??

Re: Command accounting with ACS

jain.nitin — Thu, 09 Jul 2009 18:12:55 GMT

HI It worked when I did not use any method list with the default list it works.. I dont understand why it is not working with my defined list...is there any other procedure to define method list..