39-52
Catalyst 6500 Series Switch Software Configuration Guide—Release 8.7
OL-8978-04
Chapter 39 Configuring the Switch Access Using AAA
Understanding How Accounting Works
Understanding How Accounting Works
These sections describe how the different accounting methods work:
•
Accounting Overview, page 39-52
•
Accounting Events, page 39-52
•
Specifying When to Create Accounting Records, page 39-53
•
Specifying RADIUS Servers, page 39-53
•
Updating the Server, page 39-54
•
Suppressing Accounting, page 39-54
Accounting Overview
You can configure these accounting methods to monitor access to the switch:
•
accounting
•
RADIUS accounting
Accounting allows you to track user activity to a specified host, suspicious connection attempts in the
network, and unauthorized changes to the NAS configuration itself. The accounting information is sent
to the accounting server where it is saved as a record. Accounting information typically consists of the
user’s action and the duration for which the action lasted. You can use accounting for security, billing,
and resource allocation purposes.
The accounting protocol operates in a client-server model using TCP for transport. The NAS acts as the
client and the accounting server acts as the daemon. The NAS sends accounting information to the server.
The server, after successfully processing the information, sends a response to the NAS, acknowledging
the request. All transactions between the NAS and server are authenticated using a key.
Once accounting has been enabled and an accountable event occurs on the system, the accounting
information is gathered dynamically in memory. When the event ends, an accounting record is created
and sent to the NAS, and then the system deletes the record from memory. The amount of memory that
is used by the NAS for accounting varies depending on the number of concurrent accountable events.
Accounting Events
You can configure accounting for these event types:
•
EXEC mode accounting—Provides information about user EXEC sessions (normal login sessions)
on the NAS (includes the duration of the EXEC session but does not include the traffic statistics).
•
Connect accounting—Provides information about all the outbound connections from the NAS (such
as Telnet, rlogin).
Note
If you get a connection immediately upon login and then your connection terminates, the
EXEC and connect events overlap and have almost identical start and stop times.
