Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Cisco Secure ACS

Hi,

I would like to know is there a way to perform audit trail for the network devices (router/switch using Cisco Secure ACS. At the moment, the ACS only provides information who and where the person logged into the network, but there is no detailed information about the commands issued on the router or switch. Is there something needs to be configured on the ACS and also the router and switch in order to have full details of the commands configured on the network devices from the ACS logs ?

5 REPLIES

Re: Cisco Secure ACS

Hi,

Cisco ACS can actually provide accounting on commands executed by the admin/operator whenever they access routers and switches.

There are 2 parts need to be done:

1. Configure ACS Server:

- add router/switch as AAA Client in ACS (http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_user_guide_chapter09186a0080205a54.html#wp597030)

- need to provide hostname, IP Address, secret key between ACS and AAA clients, use TACACS+ as mandatory authentication protocol.

- In your existing group and user ID, you can maintain the database where users are authenticated against.

http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_user_guide_chapter09186a0080205a5c.html

2. Configure Router/Switch

- enable aaa (see http://www.cisco.com/en/US/products/hw/switches/ps708/products_module_configuration_guide_chapter09186a0080577bde.html for example)

- configure/add ACS server as tacacs-server. Use same secret key applied in ACS when adding the device as AAA Client.

- (optional) - define tacacs "ip tacacs source-interface"

But I assumed you already configured your router/switch with AAA, except no auditting on commands executed by the operator/admin.

What you need to add is the "aaa accounting" parameter:

aaa accounting exec default start-stop group tacacs+

aaa accounting commands 15 default start-stop group tacacs+

aaa accounting network default start-stop group tacacs+

aaa accounting connection default start-stop group tacacs+

Rgds,

AK

New Member

Re: Cisco Secure ACS

Hi AK,

I had tested it just now and it's working fine. Thank you so much for your help.

regards,

Joseph

Silver

Re: Cisco Secure ACS

Hi

Generating the logs is of course only the start of the story.

To do something meaningful with it you need an application like aaa-reports! We're totally focused on AAA and have a free trial for download:

www.extraxi.com/requesttrial.htm

Regards

Darran

Re: Cisco Secure ACS

I think, the 'aaa accounting' part is what you really need for the auditing purposes.

Pls rate all useful post(s).

Rgds,

AK

Silver

Re: Cisco Secure ACS

Lets be clear, having aaa accounting enabled provides the raw data for audit.

It doesnt tick the "audit.. job done" box.

When you have a quarters worth of logs and need to know who did what to a specific device on a given day on a given interface because an external auditor is asking - you'll be greatful for giving aaa-reports! a try.

322
Views
0
Helpful
5
Replies
CreatePlease login to create content