
17-13
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
OL-20748-01
Chapter 17 Applying AAA for Network Access
Configuring Accounting for Network Access
Note
In Cisco Secure ACS, the value for filter-id attributes are specified in boxes in the HTML interface,
omitting
filter-id=
and entering only
acl_name
.
For information about making unique per user the filter-id attribute value, see the documentation for your
RADIUS server.
See the
“Adding an Extended Access List” section on page 13-6
to create an access list on the FWSM.
Configuring Accounting for Network Access
The FWSM can send accounting information to a RADIUS or server about any TCP or UDP
traffic that passes through the FWSM. If that traffic is also authenticated, then the AAA server can
maintain accounting information by username. If the traffic is not authenticated, the AAA server can
maintain accounting information by IP address. Accounting information includes when sessions start
and stop, username, the number of bytes that pass through the FWSM for the session, the service used,
and the duration of each session.
To configure accounting, perform the following steps:
Step 1
If you want the FWSM to provide accounting data per user, you must enable authentication. For more
information, see the
“Enabling Network Access Authentication” section on page 17-3
. If you want the
FWSM to provide accounting data per IP address, enabling authentication is not necessary and you can
continue to the next step.
Step 2
Using the
access-list
command, create an access list that identifies the source addresses and destination
addresses of traffic you want accounted. For steps, see the
“Adding an Extended Access List” section on
page 13-6
.
The
permit
ACEs mark matching traffic for authorization, while
deny
entries exclude matching traffic
from authorization.
Note
If you have configured authentication and want accounting data for all the traffic being
authenticated, you can use the same access list you created for use with the
aaa authentication
match
command.
Step 3
To enable accounting, enter the following command:
hostname(config)#
aaa accounting match
acl_name
interface_name
server_group
Note
Alternatively, you can use the
aaa accounting include
command (which identifies traffic within
the command) but you cannot use both methods in the same configuration. See the
Catalyst 6500
Series Switch and Cisco 7600 Series Router Firewall Services Module Command Reference
for
more information.
The following commands authenticate, authorize, and account for inside Telnet traffic. Telnet traffic to
servers other than 209.165.201.5 can be authenticated alone, but traffic to 209.165.201.5 requires
authorization and accounting.
Summary of Contents for 6500 - Catalyst Series 10 Gigabit EN Interface Module Expansion
Page 35: ...P A R T 1 Getting Started and General Information ...
Page 36: ......
Page 297: ...P A R T 2 Configuring the Security Policy ...
Page 298: ......
Page 521: ...P A R T 3 System Administration ...
Page 522: ......
Page 613: ...P A R T 4 Reference ...
Page 614: ......