cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
659
Views
0
Helpful
4
Replies

AAA accounting issue

limtohsoon
Level 1
Level 1

Hi Sir,

I have the following AAA accounting commands on an IOS device:

aaa accounting exec default start-stop group tacacs+

aaa accounting commands 15 default start-stop group tacacs+

aaa accounting network default start-stop group tacacs+

aaa accounting system default start-stop group tacacs+

On the ACS server, I checked the TACACS+ Accounting logs. Under the "cmd-arg" column, I don't see any commands that user typed on the IOS device being logged.

What am I missing? Please advise.

Thank you.

B.Rgds,

Lim TS

4 Replies 4

Premdeep Banga
Level 7
Level 7

You need to check TACACS+ Administration logs not Accounting logs.

And if you have ACS version 4.1(1) Build 23.

Then you need to patch that version to over come a known issue regarding Command Accounting on ACS.

http://www.cisco.com/cgi-bin/tablebuild.pl/acs-win-3des

- Acs-4.1.1.23.5-SW.zip

- Acs-4.1.1.23.5-Readme.txt

Regards,

Prem

Hi Prem,

I forgot to mention it is an ACS Solution Engine version 4.1(1) Build 23.

I found one patch, which is, acs_hotfix_kb828028.zip.

Is this the only patch I need to apply on the ACS SE? I'm not very familiar because this is my first deployment of ACS SE.

What about my AAA accounting commands on the IOS devices? Are they correct?

Please advise further.

Thank you.

B.Rgds,

Lim TS

I would use the following:

aaa accounting exec default start-stop group tacacs+

aaa accounting commands 0 default start-stop group tacacs+

aaa accounting commands 1 default start-stop group tacacs+

aaa accounting commands 15 default start-stop group tacacs+

aaa accounting network default start-stop group tacacs+

aaa accounting connection default start-stop group tacacs+

aaa accounting system default start-stop group tacacs+

aaa accounting resource default start-stop group tacacs+

aaa accounting resource default start-stop group tacacs+

CCIE Security

Hi Lim,

As you have ACS SE 4.1(1) Build 23, you are definitely hitting the accounting bug, you need to apply following patch,

http://www.cisco.com/cgi-bin/tablebuild.pl/acs-soleng-3des

- applACS-4.1.1.23.5.zip

- applAcs-4.1.1.23.5.txt

Regards,

Prem

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: