topic Re: Radius in Network Access Control

Radius

jigz.bagsicjr — Sun, 10 Mar 2019 22:10:34 GMT

Hi, i would like to know if there is a way to account the commands entered by certain profile log-in to the router/switch using MS IAS method? Currently i'm using IAS radius server from my switches and routers. And i'm having problem in doing an accounting of commands.

Thanks!

Re: Radius

palomoj — Thu, 24 May 2007 16:22:23 GMT

Actually, I just reviewed the IAS capabilities and you should be able to do accounting. Do you have accounting logging enabled on the IAS server? Do you also have the appropriate AAA accounting commands implemented. Please post your AAA accounting related commands.

Thanks.

Re: Radius

jigz.bagsicjr — Thu, 24 May 2007 16:27:15 GMT

i see, just last question. Is there any unix/linux based application that can support this accounting of commands aside from Cisco ACS?

Re: Radius

Premdeep Banga — Sat, 26 May 2007 22:53:41 GMT

Hi,

The Cisco Systems implementation of RADIUS does not support command accounting.

http://www.cisco.com/univercd/cc/td/doc/product/software/ios124/124cg/hsec_c/part05/schacct.htm#wp1001268

Regards,

Prem

Re: Radius

srue — Wed, 30 May 2007 13:01:27 GMT

Prem is correct. All radius can do in Cisco is send the start and stop bits...no command accounting anyway. try tacacs+. (of course IAS doesn't support this).

Re: Radius

jigz.bagsicjr — Sat, 09 Jun 2007 09:28:57 GMT

Not sure, are you talking on the "Remote Acces Logging"? If so, i used the default Local file logs from the IAS server.

Below are my commands.

aaa new-model

aaa authentication login default group radius line

aaa authentication login radius_localcon local-case

aaa authorization exec default group radius if-authenticated

aaa authorization network default group radius

aaa accounting network default start-stop group radius

aaa accounting system default start-stop group radius

radius-server host xx.xx.xx.xx auth-port 1645 acct-port 1646

radius-server source-ports 1645-1646

radius-server key 7 xxxxxxxxxxx

Please feel free to suggest on how i could implement accounting with repsect to the commands that has been entered by the admin users logged-in from my routers/switches using the IAS.

Thanks!