Cisco 7604 Configuration Guide - Page 357

Chapter 17 Applying AAA for Network Access Configuring Accounting for Network Access Note In Cisco Secure ACS, the value for filter-id attributes are specified in boxes in the HTML interface, omitting filter-id= and entering only acl_name. For information about making unique per user the filter-id attribute value, see the documentation for your RADIUS server. See the "Adding an Extended Access List" section on page 13-6 to create an access list on the FWSM. Configuring Accounting for Network Access The FWSM can send accounting information to a RADIUS or TACACS+ server about any TCP or UDP traffic that passes through the FWSM. If that traffic is also authenticated, then the AAA server can maintain accounting information by username. If the traffic is not authenticated, the AAA server can maintain accounting information by IP address. Accounting information includes when sessions start and stop, username, the number of bytes that pass through the FWSM for the session, the service used, and the duration of each session. To configure accounting, perform the following steps: Step 1 Step 2 If you want the FWSM to provide accounting data per user, you must enable authentication. For more information, see the "Enabling Network Access Authentication" section on page 17-3. If you want the FWSM to provide accounting data per IP address, enabling authentication is not necessary and you can continue to the next step. Using the access-list command, create an access list that identifies the source addresses and destination addresses of traffic you want accounted. For steps, see the "Adding an Extended Access List" section on page 13-6. The permit ACEs mark matching traffic for authorization, while deny entries exclude matching traffic from authorization. Note If you have configured authentication and want accounting data for all the traffic being authenticated, you can use the same access list you created for use with the aaa authentication match command. Step 3 To enable accounting, enter the following command: hostname(config)# aaa accounting match acl_name interface_name server_group Note Alternatively, you can use the aaa accounting include command (which identifies traffic within the command) but you cannot use both methods in the same configuration. See the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Command Reference for more information. The following commands authenticate, authorize, and account for inside Telnet traffic. Telnet traffic to servers other than 209.165.201.5 can be authenticated alone, but traffic to 209.165.201.5 requires authorization and accounting. OL-20748-01 Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM 17-13