Configuring AAA Services on Cisco IOS XR Software
How to Configure AAA Services
SC-47
Cisco IOS XR System Security Configuration Guide for the Cisco CRS-1 Router
OL-20382-01
DETAILED STEPS
Command or Action Purpose
Step 1
configure
Example:
RP/0/RP0/CPU0:router# configure
Enters global configuration mode.
Step 2
aaa accounting {commands | exec | network}
{default | list-name} {start-stop | stop-only}
{none | method}
Example:
RP/0/RP0/CPU0:router(config)# aaa accounting
commands default stop-only group tacacs+
Creates a series of accounting methods, or a method list.
• The commands keyword enables accounting for EXEC
shell commands.
• The exec keyword enables accounting for an interactive
(EXEC) session.
• The network keyword enables accounting for all
network-related service requests, such as
Point-to-Point Protocol (PPP).
• The default keyword causes the listed accounting
methods that follow this keyword to be the default list
of methods for accounting.
• A list-name character string identifies the accounting
method list.
• The start-stop keyword sends a “start accounting”
notice at the beginning of a process and a “stop
accounting” notice at the end of a process. The
requested user process begins regardless of whether the
“start accounting” notice was received by the
accounting server.
• The stop-only keyword sends a “stop accounting”
notice at the end of the requested user process.
• The none keyword states that no accounting is
performed.
• The method list itself follows the start-stop keyword.
Method list types are entered in the preferred sequence.
The method argument lists the following types:
–
group tacacs+—Use the list of all configured
TACACS+ servers for accounting.
–
group radius—Use the list of all configured
RADIUS servers for accounting.
–
group group-name—Use a named server group, a
subset of TACACS+ or RADIUS servers for
accounting as defined by the aaa group server
tacacs+ or aaa group server radius command.
• The example defines a default command accounting
method list, in which accounting services are provided
by a TACACS+ security server, with a stop-only
restriction.