AAA Authentication on Cisco IOS

Hello Azm!

All of these commands involve the accounting of users connecting to the device as well as of events that occur on the device. Specifically, accounting management in this context is a mechanism that allows you to track individual and group usage of network resources. The different commands above configure what, how and when this information is recorded. Accounting information can be stored locally on the device, but more commonly is sent to an AAA (Authentication, Authorization and Accounting) server.

You can find detailed information about the aaa accounting commands and keywords here.

However, I will briefly explain the above commands:

First of all, the start-stop and stop-only keywords indicate to the device when to send accounting information to the AAA server, either at both the beginning and end of a process or command, or only at the end.

The group tacacs+ keywords indicate the list of TACACS+ servers
to be used for AAA which are those found in the aaa group server tacacs+ command.

The default keyword just states that the keywords that follow will be the default parameters used for the accounting mechanism.

Now for the commands themselves:

aaa accounting exec default start-stop group tacacs+
This command activates accounting on all EXEC shell sessions (any commands entered after the enable command) and sends accounting information at the beginning and end of each command/process to the server indicated by group tacacs+.

aaa accounting commands 1 default stop-only group tacacs+
This command activates accounting on all commands entered at privilege level 1 and sends accounting information at the end of each command/process to the server indicated by group tacacs+.

aaa accounting commands 15 default stop-only group tacacs+
This command activates accounting on all commands entered at privilege level 15 and sends accounting information at the end of each command/process to the server indicated by group tacacs+.

aaa accounting connection default start-stop group tacacs+
This command activates accounting on all outbound connections made from the device such as telnet and others and sends accounting information at the beginning and end of each command/process to the server indicated by group tacacs+.

aaa accounting system default start-stop group tacacs+
This command activates accounting for for all system-level events not associated with users, such as reloads. Accounting information is sent at the beginning and end of each process to the server indicated by group tacacs+.

I hope this has been helpful!

Laz