background image
384 Chapter 12: Using AAA to Scale Access Control in an Expanding Network
·
wait-start--As mentioned, the wait-start option does not allow the user process to start
until an acknowledgement is received from the accounting database engine by the RAS
device. wait-start is particularly important when the tracked event can cause a loss of
connectivity with the accounting database.
The last piece of information needed for the router or RAS is where to send the information that
is being tracked. The where-to-send-the-information argument can be either of the following
locations:
·
tacacs+--When this option is used, the information is sent to the TACACS+ server
defined by the tacacs-server host ip-address command.
·
radius--When this option is used, the information is sent to the RADIUS server database
defined by the radius-server host ip-address command. The current Cisco
implementation does not support the command accounting feature.
Example 12-6 shows a simple accounting setup.
In the first line, accounting has been activated for all level 15 commands to show when the
command began and when it ended for the user that initiated the command. The second line logs
to the database when the user's connection began and when it ended. In the last statement, any
system-level events, such as a reload or configuration change, are tracked by start and end time.
The wait-start argument assures that the logging of the start of the system event is acknowledged
before the event is allowed to start. The key issue here is that if the event is a reload of the router,
it is imperative that the event be logged and acknowledged before the router reloads. If the
message is missed or lost in transmission, the event would go unrecorded.
The basics of accounting are that the accounting records are sent to a TACACS+ server or a
RADIUS server. In addition, the records that are to be tracked should be recorded to the router
with the AAA accounting commands.
Accounting is a powerful tool for proactive management of network resources; however, it is a
double-edged sword. The more accounting, the more resources are used to accomplish the
accounting. It is generally recommended that the stop-only argument be used if an elapsed time
is not needed.
The format of accounting records depends on the AAA software that is being used. The
treatment of AAA within the confines of the BCRAN class is intended to give the student a
basic understanding of AAA. All AAA software engines can provide the same or similar
functionality; it is impossible to describe the intricacies of an individual software suite as the
standard for AAA.
Example 12-6
AAA Accounting Setup
Router(config)#aaa accounting command 15 start-stop tacacs+
Router(config)#aaa accounting connection start-stop tacacs+
Router(config)#aaa accounting system wait-start tacacs+