Tracking the executed commands

[kendo.igor]

We are using Microsoft IAS Radius server for authentication to a large number of Cisco routers in our organization. Is it possible to log the commands that are entered on routers (Whether console or telnet session) for audit purposes? If so, is there a document on how to do implement it?

[parmsing]

Hi,

That is very much possible but I am not sure if IAS logging supports it. Here are the commands we need to configure on IOS devcie.

aaa accounting exec default start-stop group tacacs+

aaa accounting commands 0 default start-stop group tacacs+/Radius

aaa accounting commands 1 default start-stop group tacacs+/Radius

aaa accounting commands 15 default start-stop group tacacs+/Radius

HTH

Parminder

[Premdeep Banga]

Unfortunately its not possible using IAS, as it only supports Radius protocol.

And you are looking for is covered under TACACS+ protocol (Cisco ACS)

Regards,

Prem

[parmsing]

Hi,

My apologies for the incorrect information, I recreated this issue and Prem is correct, we cannot configure radius accounting for the commands. Tacacs is the only option available for the command accounting.

Thanks

Parminder

[Collin Clark]

Check this out.

http://www.cisco.com/en/US/products/ps6350/products_configuration_guide_chapter09186a0080454f73.html

HTH and please rate.

[Richard Burts]

Collin

This is a very neat feature that I was not aware of. I believe it deserves the 5 rating that I gave it.

HTH

Rick

[royalblues]

Indeed a very good feature.

rated :-)

Narayan

[nspasov]

The link no longer seems to be valid. What is the neat/good feature that you guys are talking about ??