Logging certificate authentication

[patrickdonlon]

We have a solution where user vpn to a router and use cert's for authentication. This works fine but there is no record of who's logged in and for how long, what's the best practice for logging the accounting information?

[Marcin Latosiewicz]

RADIUS accounting is your best choice.

R3(config)#crypto isakmp profile PRO
% A profile is deemed incomplete until it has match identity statements
R3(conf-isa-prof)#?
Crypto ISAKMP Profile Commands are:
  accounting        Enable AAA Accounting for IPSec Sessions

or

R3(config)#crypto map MAP client accounting list ?
  WORD  Named accounting list.

HTH,

M.