IBM RackSwitch G8000, Application Manual

Page: 70 / 362

68
RackSwitch G8000: Application Guide
Accounting
Accounting is the action of recording a user's activities on the device for the
purposes of billing and/or security. It follows the authentication and authorization
actions. If the authentication and authorization is not performed via , there
are no accounting messages sent out.
You can use to record and track software login access, configuration
changes, and interactive commands.
The G8000 supports the following accounting attributes:
•
protocol (console/Telnet/SSH/HTTP/HTTPS)
• start_time
• stop_time
• elapsed_time
• disc_cause
Note: When using the Browser-Based Interface, the Accounting Stop
records are sent only if the Logout button on the browser is clicked.
Command Authorization and Logging
When Command Authorization is enabled, N/OS configuration
commands are sent to the server for authorization. Use the following
command to enable Command Authorization:
When Command Logging is enabled, N/OS configuration commands are
logged on the server. Use the following command to enable
Command Logging:
The following examples illustrate the format of N/OS commands sent to the
server:
Configuring Authentication on the Switch
1. Configure the IPv4 addresses of the Primary and Secondary
servers, and enable TACACS authentication.
Note: You can use a configured loopback address as the source address so the
server accepts requests only from the expected loopback
address block. Use the following command to specify the loopback interface:
RS G8000(config)# ip tacacs source-interface loopback
<1-5>
RS G8000(config)
# tacacs-server command-authorization
RS G8000(config)
# tacacs-server command-logging
authorization request, cmd=shell, cmd-arg=interface ip
accounting request, cmd=shell, cmd-arg=interface ip
authorization request, cmd=shell, cmd-arg=enable
accounting request, cmd=shell, cmd-arg=enable
RS G8000(config)#
tacacs-server primary-host 10.10.1.1
RS G8000(config)#
tacacs-server secondary-host 10.10.1.2
RS G8000(config)#
tacacs-server enable