Configuration Examples for AAA Accounting Example: Configuring a Named Method List The following example shows how to configure a Cisco device (enabled for AAA and communication with a RADIUS security server) in order for AAA services to be provided by the RADIUS server. If the RADIUS server fails to respond, then the local database is queried for authentication and authorization information, and accounting services are handled by a TACACS+ server.
Device# configure terminal Device(config)# aaa new-model Device(config)# aaa authentication login admins local Device(config)# aaa authentication ppp dialins group radius local Device(config)# aaa authorization network network1 group radius local Device(config)# aaa accounting network network2 start-stop group radius group tacacs+ Device(config)# username root password ALongPassword Device(config)# tacacs server server1 Device(config-server-tacacs)# address ipv4 172.31.255.0 Device(config-server-tacacs)# key goaway Device(config-server-tacacs)# exit Device(config)# radius server isp Device(config-sg-radius)# key myRaDiUSpassWoRd Device(config-sg-radius)# exit Device(config)# interface group-async 1 Device(config-if)# group-range 1 16 Device(config-if)# encapsulation ppp Device(config-if)# ppp authentication chap dialins Device(config-if)# ppp authorization network1 Device(config-if)# ppp accounting network2 Device(config-if)# exit Device(config)# line 1 16 Device(config-line)# autoselect ppp Device(config-line)# autoselect during-login Device(config-line)# login authentication admins Device(config-line)# modem dialin Device(config-line)# end The lines in this sample RADIUS AAA configuration are defined as follows:
• The aaa new-model command enables AAA network security services. • The aaa authentication login admins local command defines a method list, “admins”, for login authentication. • The aaa authentication ppp dialins group radius local command defines the authentication method list “dialins”, which specifies that first RADIUS authentication and then (if the RADIUS server does not respond) local authentication is used on serial lines using PPP. • The aaa authorization network network1 group radius local command defines the network authorization method list named “network1”, which specifies that RADIUS authorization is used on serial lines using PPP.
If the RADIUS server fails to respond, then local network authorization is performed. • The aaa accounting network network2 start-stop group radius group tacacs+ command defines the network accounting method list named “network2”, which specifies that RADIUS accounting services Configuring Accounting Configuration Examples for AAA Accounting Configuring Accounting 22