Cisco Secure ACS

[josephn]

Hi,

I would like to know is there a way to perform audit trail for the network devices (router/switch using Cisco Secure ACS. At the moment, the ACS only provides information who and where the person logged into the network, but there is no detailed information about the commands issued on the router or switch. Is there something needs to be configured on the ACS and also the router and switch in order to have full details of the commands configured on the network devices from the ACS logs ?

[a.kiprawih]

Hi,

Cisco ACS can actually provide accounting on commands executed by the admin/operator whenever they access routers and switches.

There are 2 parts need to be done:

1. Configure ACS Server:

- add router/switch as AAA Client in ACS (http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_user_guide_chapter09186a0080205a54.html#wp597030)

- need to provide hostname, IP Address, secret key between ACS and AAA clients, use TACACS+ as mandatory authentication protocol.

- In your existing group and user ID, you can maintain the database where users are authenticated against.

http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_user_guide_chapter09186a0080205a5c.html

2. Configure Router/Switch

- enable aaa (see http://www.cisco.com/en/US/products/hw/switches/ps708/products_module_configuration_guide_chapter09186a0080577bde.html for example)

- configure/add ACS server as tacacs-server. Use same secret key applied in ACS when adding the device as AAA Client.

- (optional) - define tacacs "ip tacacs source-interface"

But I assumed you already configured your router/switch with AAA, except no auditting on commands executed by the operator/admin.

What you need to add is the "aaa accounting" parameter:

aaa accounting exec default start-stop group tacacs+

aaa accounting commands 15 default start-stop group tacacs+

aaa accounting network default start-stop group tacacs+

aaa accounting connection default start-stop group tacacs+

Rgds,

AK

[josephn]

Hi AK,

I had tested it just now and it's working fine. Thank you so much for your help.

regards,

Joseph

[darpotter]

Hi

Generating the logs is of course only the start of the story.

To do something meaningful with it you need an application like aaa-reports! We're totally focused on AAA and have a free trial for download:

www.extraxi.com/requesttrial.htm

Regards

Darran

[a.kiprawih]

I think, the 'aaa accounting' part is what you really need for the auditing purposes.

Pls rate all useful post(s).

Rgds,

AK

[darpotter]

Lets be clear, having aaa accounting enabled provides the raw data for audit.

It doesnt tick the "audit.. job done" box.

When you have a quarters worth of logs and need to know who did what to a specific device on a given day on a given interface because an external auditor is asking - you'll be greatful for giving aaa-reports! a try.