• TACACS+: The network access server reports user activity to the TACACS+ security server in the form of accounting records. Each accounting record contains accounting AV pairs and is stored on the security server. • RADIUS: The network access server reports user activity to the RADIUS security server in the form of accounting records. Each accounting record contains accounting AV pairs and is stored on the security server. Note Passwords and accounting logs are masked before being sent to the TACACS+ or RADIUS security servers. Use the aaa accounting commands visible-keys command to send unmasked information to the TACACS+ or RADIUS security servers.
Accounting Record Types For minimal accounting, use the stop-only keyword, which instructs the specified method ( RADIUS or TACACS+ ) to send a stop record accounting notice at the end of the requested user process. For more accounting information, use the start-stop keyword to send a start accounting notice at the beginning of the requested event and a stop accounting notice at the end of the event. To stop all accounting activities on this line or interface, use the none keyword. Accounting Methods The table below lists the supported accounting methods. Table 1: AAA Accounting Methods The method argument refers to the actual method the authentication algorithm tries.
Additional methods of authentication are used only if the previous method returns an error, not if it fails. To specify that the authentication should succeed even if all other methods return an error, specify additional methods in the command. For example, to create a method list named acct_tac1 that specifies RADIUS as the backup method of authentication in the event that TACACS+ authentication returns an error, enter the following command:
aaa accounting network acct_tac1 stop-only group tacacs+ group radius To create a default list that is used when a named list is not specified in the aaa accounting command, use the default keyword followed by the methods that are wanted to be used in default situations. The default method list is automatically applied to all interfaces. For example, to specify RADIUS as the default method for user authentication during login, enter the following command: aaa accounting network default stop-only group radius AAA Accounting supports the following methods: Configuring Accounting Accounting Record Types Keyword Description group radius Uses the list of all RADIUS servers for accounting.
group tacacs+ Uses the list of all TACACS+ servers for accounting. group group-name Uses a subset of RADIUS or TACACS+ servers for accounting as defined by the server group group-name. Configuring Accounting 4