Cisco Systems ASA5515K9, ASA 5500 - page 793

38-19
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter38 Configuring AAA Rules for Network Access
Configuring Accounting for Network Access
Examples
The following example authenticates, authorizes, and accounts for inside Telnet traffic. Telnet traffic to
servers other than 209.165.201.5 can be authenticated alone, but traffic to 209.165.201.5 requires
authorization and accounting.
hostname(config)# aaa-server AuthOutbound protocol tacacs+
hostname(config-aaa-server-group)# exit
hostname(config)# aaa-server AuthOutbound (inside) host 10.1.1.1
hostname(config-aaa-server-host)# key TACPlusUauthKey
hostname(config-aaa-server-host)# exit
hostname(config)# access-list TELNET_AUTH extended permit tcp any any eq telnet
hostname(config)# access-list SERVER_AUTH extended permit tcp any host 209.165.201.5 eq
telnet
hostname(config)# aaa authentication match TELNET_AUTH inside AuthOutbound
hostname(config)# aaa authorization match SERVER_AUTH inside AuthOutbound
hostname(config)# aaa accounting match SERVER_AUTH inside AuthOutbound
Command Purpose
Step1 access-list
Example:
hostname(config)# access-list TELNET_AUTH extended
permit tcp any any eq telnet
If you want the ASA to provide accounting data per
user, you must enable authentication. For more
information, see the “Configuring Network Access
Authentication” section on page 38-4. If you want
the ASA to provide accounting data per IP address,
enabling authentication is not necessary.
Creates an access list that identifies the source
addresses and destination addresses of traffic for
which you want accounting data. For instructions,
see Chapter 15, “Adding an Extended Access List.”
The permit ACEs mark matching traffic for
accounting, while deny entries exclude matching
traffic from accounting.
Note If you have configured authentication and
want accounting data for all the traffic being
authenticated, you can use the same access
list that you created for use with the aaa
authentication match command.
Step2 aaa accounting match acl_name interface_name
server_group
Example:
hostname(config)# aaa accounting match SERVER_AUTH
inside AuthOutbound
Enables accounting.
The acl_name argument is the access list name set in
the access-list command.
The interface_name argument is the interface name
set in the nameif command.
The server_group argument is the server group
name set in the aaa-server command.
Note Alternatively, you can use the aaa
accounting include command (which
identifies traffic within the command), but
you cannot use both methods in the same
configuration. See the command reference
for more information.