cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

220
Views
0
Helpful
3
Replies
Charles_Chi4
Beginner

username in accounting report

Hello, i wonder how could i get accounting of who get in asa n what have he done to asa.

I already input :

aaa accounting command <group>

aaa accounting enable console <group>

aaa accounting telnet console <group>

And i can see who login in tacac+ accounting.

But i can't see who have input command in tacac+ administration. I just see enable_15 as the username.

3 REPLIES 3
Jagdeep Gambhir
Advocate

Chris,

You need to add this command,

aaa authentication enable console LOCAL

That should fix the issue.

~Regards

~JG

i've tried to add that command, but after that no one can login. I have to block asa connection to ACS so it could revert to local authentication.

Is there any solution?

whenever we do enable authentication, you also need to, on ACS on user accounts , check the appropriate option for "TACACS+ Enable Password"

under "Advanced TACACS+ Settings"

By default its, "Use separate password" which is blank.

So if your user account is local on ACS use "Use CiscoSecure PAP password" or if you are being authenticated from some external database check "Use external database password".....

If you are not able to see the option, the enable it from Interface Configuration > Advanced Option section.

then you'll be able to log into enable mode, and see who made the changes in the logs.

Regards,

Prem

Content for Community-Ad