Cisco 5505 - ASA Firewall Edition Bundle, Cli Configuration Manual

Page: 1050 / 2164

1-22
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring AAA Rules for Network Access
Configuring Accounting for Network Access
accounting information by IP address. Accounting information includes session start and stop times,
username, the number of bytes that pass through the ASA for the session, the service used, and the
duration of each session.
To configure accounting, perform the following steps:
Examples
The following example authenticates, authorizes, and accounts for inside Telnet traffic. Telnet traffic to
servers other than 209.165.201.5 can be authenticated alone, but traffic to 209.165.201.5 requires
authorization and accounting.
hostname(config)# aaa-server AuthOutbound protocol
hostname(config-aaa-server-group)#
exit
hostname(config)# aaa-server AuthOutbound (inside) host 10.1.1.1
hostname(config-aaa-server-host)# key TACPlusUauthKey
Command Purpose
Step 1
access-list
Example:
hostname(config)# access-list TELNET_AUTH extended
permit tcp any any eq telnet
If you want the ASA to provide accounting data per
user, you must enable authentication. For more
information, see the
“Configuring Network Access
Authentication” section on page 1-7 . If you want the
ASA to provide accounting data per IP address,
enabling authentication is not necessary.
Creates an access list that identifies the source
addresses and destination addresses of traffic for
which you want accounting data. For instructions,
see
Chapter 1, “Adding an Extended Access Control
List.”
The permit ACEs mark matching traffic for
accounting, while deny entries exclude matching
traffic from accounting.
Note
If you have configured authentication and
want accounting data for all the traffic being
authenticated, you can use the same access
list that you created for use with the
aaa
authentication match command.
Step 2
aaa accounting match acl_name interface_name
server_group
Example:
hostname(config)# aaa accounting match SERVER_AUTH
inside AuthOutbound
Enables accounting.
The acl_name argument is the access list name set in
the access-list command.
The interface_name argument is the interface name
set in the nameif command.
The server_group argument is the server group
name set in the aaa-server command.
Note
Alternatively, you can use the aaa
accounting include command (which
identifies traffic within the command), but
you cannot use both methods in the same
configuration. See the command reference
for more information.