Configuring Accounting

To configure accounting on the Cisco ASA, use the aaa accounting command:

  aaa accounting match access_list_name if_name server_tag

Example 7-17 demonstrates how to configure accounting on the Cisco ASA.

Example 7-17. Enabling Accounting Using an ACL to Define Interesting Traffic

Chicago(config)# access-list 100 permit ip 10.1.1.0 255.255.255.0 172.18.124.0

255.255.255.0

Chicago(config)# aaa accounting match 100 inside mygroup

In Example 7-17, an ACL is configured to enable accounting for all connections initiated from 10.1.1.0/24 to 172.18.124.0/24. The ACL is then applied to the aaa accounting match command. A previously defined AAA server group named mygroup is used with this command.

Note

You can also use the aaa accounting include | exclude command options, as demonstrated for the aaa authentication command. The aaa accounting match command makes the include and exclude options obsolete.

RADIUS Accounting

Table 7-8 lists all the RADIUS accounting messages supported by Cisco ASA.

Table 7-8. RADIUS Accounting Messages Supported by Cisco ASA
Attribute
Applicable Messages
acct-authentic
on, off, start, stop
acct-delay-time
on, off, start, stop
acct-status-type
on, off, start, stop
acct-session-id
start, stop
nas-ip-address
on, off, start, stop
nas-port
on, off, start, stop
user-name
on, off, start, stop
class
start, stop
service type
start, stop
framed-protocol
start, stop
framed-ip-address
start, stop
tunnel-client-endpoint
start, stop
acct-session-time
stop
acct-input-packets
stop
acct-output-packets
stop
acct-input-octets
stop
acct-output-octets
stop
acct-terminate-cause
stop
login-ip-host
on, off, start, stop
login-port
on, off, start, stop
Cisco AV pair (used to send source addr/port and dest addr/port)
on, off, start, stop
isakmp-initiator-ip
on, off, start, stop
isakmp-phase1-id
on, off, start, stop
isakmp-group-id
on, off, start, stop
acct-input-gigawords
stop
acct-output-gigawords
stop

The accounting-on message marks the start of accounting services. Subsequently, to mark the end of accounting services, use the accounting-off message. The start and stop accounting records are used to label when a user started a connection to a specific service. These sessions are labeled with their own accounting session IDs.

TACACS+ Accounting

Table 7-9 lists all the TACACS+ accounting messages that Cisco ASA supports.

Table 7-9. TACACS+ Accounting Messages Supported by Cisco ASA
Attribute
Applicable Messages
username (fixed field)
start, stop
port (NAS) (fixed field)
start, stop
remote_address (fixed field)
start, stop
task_id
start, stop
foreign_IP
start, stop
local_IP
start, stop
cmd
start, stop
elapsed_time
stop
bytes_in
stop
bytes_out
stop

Cisco ASA also allows you to configure command accounting depending on the user's privilege level. Use the following command to enable this feature:

  aaa accounting command {privilege level} tacacs_server_tag

Example 7-18 demonstrates how to configure command accounting on the Cisco ASA depending on the user's privilege level.

Example 7-18. Enabling Command Accounting

Chicago(config)# aaa accounting command privilege 15 mygroup

In Example 7-18, the accounting command is enabled for users that execute a privilege level 15 command.

< Day Day Up >