Not getting accounting logs when authenticated via https to switch

laurabriscoe · ‎03-19-2009

We have setup aaa for tacacs+ to some switches. When logging in via ssh everything works fine. When logging in via https (we have some that we have to access this way) the authentication works fine via tacacs but we get absolutely no logging in the accounting or administration logs.

Below is the commands we have in for the accounting

aaa authorization exec default group tacacs+

aaa authorization network default group tacacs+

aaa accounting commands 0 default start-stop group tacacs+

aaa accounting commands 1 default start-stop group tacacs+

aaa accounting commands 2 default start-stop group tacacs+

aaa accounting commands 3 default start-stop group tacacs+

aaa accounting commands 4 default start-stop group tacacs+

aaa accounting commands 5 default start-stop group tacacs+

aaa accounting commands 6 default start-stop group tacacs+

aaa accounting commands 7 default start-stop group tacacs+

aaa accounting commands 8 default start-stop group tacacs+

aaa accounting commands 9 default start-stop group tacacs+

aaa accounting commands 10 default start-stop group tacacs+

aaa accounting commands 11 default start-stop group tacacs+

aaa accounting commands 12 default start-stop group tacacs+

aaa accounting commands 13 default start-stop group tacacs+

aaa accounting commands 14 default start-stop group tacacs+

aaa accounting commands 15 default start-stop group tacacs+

aaa accounting connection default start-stop group tacacs+

aaa accounting exec default start-stop group tacacs+

aaa accounting network default start-stop group tacacs+

aaa accounting system default start-stop group tacacs+

We are using ACS for Windows version 4.2(0) build 124. Any help would be appreciated.

Jagdeep Gambhir · ‎03-20-2009

Please add "Ip http accounting commands level {default | named-accounting-method-list} "

The ip http accounting commands command is used to specify a particular command accounting method for HTTP server users.

Command accounting provides information about the commands for a specified privilege level that are being executed on a device. Each command accounting record corresponds to one IOS command executed at its respective privilege level, as well as the date and time the command was executed, and the user who executed it. Command accounting will be implemented for HTTP and HTTPS.

Also no need to add accounting for each priv lvl

All you need is,

aaa accounting commands 0 default start-stop group tacacs+

aaa accounting commands 1 default start-stop group tacacs+

aaa accounting commands 15 default start-stop group tacacs+

Regards,

~JG

Do rate helpful posts

robert-olsson · ‎05-13-2009

Hi,

We have the exact same problem as the user above (laurabriscoe).

Telnet and SSH is working great and is logging to the ACS in both accounting and administration.

But now we have started to let some of our local offices use CNA to manage the switches themself, but nothing is logged.

The command "Ip http accounting commands level ..." seems to be the way to go. But I can't find it in any of our switches. I have checked in different IOS versions and models (2960 and 3750) but it is not there.

So if you or someone have any other ideas of command related to get the logging for HTTP/HTTPS to work with Cisco ACS, that would have been much appriciated.

Best regards

//Robert

ansalaza · ‎05-13-2009

You might need to upgrade in order to have the command available in those Switches:

The "ip http accounting commands" command specifies a particular command accounting method for HTTP server users.

This command was introduced. 12.4(15)T.

This command was integrated into Cisco IOS Release 12.2(33)SRC.

This command was integrated into Cisco IOS Release 12.2(33)SB.

http://www.cisco.com/en/US/docs/ios/netmgmt/command/reference/nm_08.html#wp1020189

Jagdeep Gambhir · ‎05-13-2009

This is how it worked from me

1. I have configured a user on the ACS server

2. I have configured the following for accounting

aaa new-model

aaa authentication login default group tacacs local

aaa authorization exec default group tacacs local

aaa accounting commands 1 default stop-only group tacacs+

aaa accounting commands 15 default stop-only group tacacs+

tacacs-server host $ACS_Server key cisco

ip http authentication aaa

3. Enabled Debugs with:

debug tacacs accounting

4. I login to the http session with the username and password configured

in step-1 and execute commands using the webexec. The commands are being

logged on the tacacs+ server. (Cisco Secure ACS).

5. I also tried the following

aaa accounting commands 15 default start-stop group tacacs+

This also works fine.

Regards,

~JG

Do rate helpful posts