Implementing Server-Based AAA Accounting

Include the following configuration line in /opt/ciscosecure/CLI/config/CSU.cfg to enable group membership accounting:

config_acct_fn_enable = 1

For detailed accounting performance, go to:

Include the following Cisco IOS commands in your configuration file to support dialup authentication, authorization, and accounting.

aaa new-model
aaa authentication login default group radius local
aaa authentication ppp default if-needed group radius local
aaa authorization exec default group radius if-authenticated
aaa accounting exec default stop-only group radius
aaa accounting network default stop-only group radius
 

The following examples illustrate the use of SQL query commands to monitor user rad_dial being disconnected due to idletime configured with the line configuration session-timeout command in the NAS:

<CSUServer>$/export/home/oracle> sqlplus
 
SQL*Plus: Release 3.3.4.0.1 - Production on Mon Apr 17 17:41:52 2000
 
Copyright (c) Oracle Corporation 1979, 1996. All rights reserved.
 
Enter user-name:csecure/csecure@ciscoaus
Connected to:
Oracle7 Server Release 7.3.4.0.1 - Production
PL/SQL Release 2.3.4.0.0 - Production
 
SQL> select * from cs_accounting_log where blob_data like '%rad_dial%';
 
LOG_ID BLOB_ORDINAL BLOB_DATA
--------------------------------------------------------------------------------
 
172.22.87.3     rad_dial        Async20 65004   stop    server=danvers  time=17:36:33   date=04/17/2000    task_id=40      timezone=CST    service=ppp     protocol=ip     addr=172.22.83.12       disc-cause=4     disc-cause-ext=1021     pre-bytes-in=132        pre-bytes-out=139 pre-paks-in=5   pre-paks-out=7 bytes_i
 

Note The disc-cause and disc-cause-ext output both reflect idle timeouts from Table 5-1 listed in "5.3 AAA Disconnect Cause Code Descriptions" in this chapter.

Review and verify user rad_dial disconnecting session from the NAS by using the Cisco IOS show caller user and debug aaa accounting commands.

Note User rad_dial dials into maui-nas-03. Note the session-timeout was applied.

maui-nas-03#show caller user rad_dial detail
 
  User: rad_dial, line tty 20, service Async
        Active time 00:00:47, Idle time 00:00:00
  Timeouts:            Absolute  Idle      Idle
                                 Session   Exec
      Limits:          04:00:00  00:15:00  00:48:00  
      Disconnect in:   03:59:12  00:14:59  -         
  TTY: Line 20, running PPP on As20
  Location: PPP: 172.22.83.12
  DS0: (slot/unit/channel)=0/0/2
  Line: Baud rate (TX/RX) is 115200/115200, no parity, 1 stopbits, 8 databits
  Status: Ready, Active, No Exit Banner, Async Interface Active
          HW PPP Support Active, Modem Detected
  Capabilities: Hardware Flowcontrol In, Hardware Flowcontrol Out
                Modem Callout, Modem RI is CD, 
                Line usable as async interface, Modem Autoconfigure
                Integrated Modem
  Modem State: Ready, Modem Configured
 
  User: rad_dial, line As20, service PPP
        Active time 00:00:44, Idle time 00:00:08
  Timeouts:            Absolute  Idle
      Limits:          -         00:15:00  
      Disconnect in:   -         00:14:50  
 

maui-nas-03#show debug
General OS:
  AAA Accounting debugging is on 
 
*Apr 17 17:36:35.262 CST: AAA/ACCT/ACCT_DISC: Found list "default"
*Apr 17 17:36:35.262 CST: Async20 AAA/DISC: 4/"Idle Timeout"
*Apr 17 17:36:35.262 CST: AAA/ACCT/ACCT_DISC: Found list "default"
*Apr 17 17:36:35.262 CST: Async20 AAA/DISC/EXT: 1021/"Idle Timeout"
*Apr 17 17:36:35.262 CST: Async20 AAA/DISC: 4/"Idle Timeout"
*Apr 17 17:36:35.262 CST: Async20 AAA/DISC/EXT: 1021/"Idle Timeout"

Note The disc-cause and disc-cause-ext both reflect idle timeouts from Table 5-1 listed in "5.3 AAA Disconnect Cause Code Descriptions" in this chapter.

config_acct_fn_enable = 1

For detailed accounting performance, go to:

Include the following Cisco IOS commands in your configuration file to enable router EXEC and command AAA authentication, authorization, and accounting:

aaa new-model
aaa authentication login default group tacacs+ local
aaa authentication login NO_AUTHEN none
aaa authorization exec default group tacacs+ if-authenticated
aaa authorization exec NO_AUTHOR none
aaa authorization commands 15 default group tacacs+
aaa authorization commands 15 NO_AUTHOR none
aaa accounting exec default stop-only group tacacs+
aaa accounting commands 15 default stop-only group tacacs+
 
line con 0
 authorization commands 15 NO_AUTHOR
 authorization exec NO_AUTHOR
 login authentication NO_AUTHEN

Note Authentication and authorization is disabled on the console port with the use of the NO_AUTHEN and NO_AUTHOR named lists.

The following example illustrates the use of the SQL query select command to monitor user rtr_geek entering the configure terminal privilege level 15 command:

SQL>select * from cs_accounting_log where blob_data like '%rtr_geek%';
 
LOG_ID BLOB_ORDINAL     BLOB_DATA
--------------------------------------------------------------------------------
Mon Apr 17 14:06:27 2000
        Client-Id = 172.22.80.3
        Client-Port-Id = 0
        NAS-Port-Type = Async
        User-Name = "rtr_geek"
        Acct-Status-Type = Stop
 
    LOG_ID BLOB_ORDINAL   BLOB_DATA
--------------------------------------------------------------------------------
172.22.87.3     rtr_geek        tty0    async   stop    server=danvers  time=18:10:02   date=04/17/2000       task_id=52      timezone=CST    service=shell   priv-lvl=15     cmd=configure terminal <cr>
 
 

Enter the configure terminal command to test AAA accounting behavior as follows (be sure the debug aaa accounting command is enabled):

maui-nas-03#show debug
General OS:
  AAA Accounting debugging is on
maui-nas-03#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
maui-nas-03(config)#^Z
 

*Apr 17 18:14:45.722 CST: AAA/ACCT/CMD: User rtr_geek, Port tty0, Priv 15:
         "configure terminal <cr>"
*Apr 17 18:14:45.722 CST: AAA/ACCT/CMD: Found list "default"
*Apr 17 18:14:45.726 CST: AAA/ACCT: user rtr_geek, acct type 3 (1057208544): Method=tacacs+ (tacacs+)
*Apr 17 18:14:45.930 CST: TAC+: (1057208544): received acct response status = SUCCESS