This chapter is from the book
This chapter is from the book
This chapter is from the book
Configuring Accounting
To configure accounting on the Cisco ASA via ASDM, complete the following steps. The goal in the following example is to enable accounting for all IP traffic sourced from the 10.10.1.0/24 network and destined to the 10.10.2.0/24 network.
- step 1. Log in to ASDM and navigate to Configuration > Firewall > AAA Rules.
- step 2. Click on Add and select Add Accounting Rule.
- step 3. Select the interface where the accounting rule is to be applied. In this example, the inside interface is used.
- step 4. Under Action, select Account to enable accounting.
- step 5. Select the AAA server group from the AAA Server Group pull-down menu. In this example, the previously configured AAA server group called my-radius-group is used.
- step 6. You can configure the source and destination to define specific traffic traversing the Cisco ASA that is to be used for accounting. Configure the specific source IP address or network under the Source field. By default the any keyword is displayed to enable accounting for all sources. In this example, the source network 10.10.1.0/24 is used.
- step 7. Configure the specific destination IP address or network under the Destination field. By default, the any keyword is displayed to enable accounting for all sources. In this example, the destination network 10.10.2.0/24 is used.
- step 8. Select the specific service or protocol in the Service field. In this example, the ip keyword is used to enable accounting for all IP traffic sourced from the 10.10.1.0/24 network and destined to the 10.10.2.0/24 network.
- step 9. Optionally, you can enter a description for this accounting rule in the Description field.
- step 10. Click Apply to apply the configuration changes.
- step 11. Click Save to save the configuration in the Cisco ASA.
To enable accounting via the CLI use the aaa accounting command:
aaa accounting match access_list_name if_name server_tag
Example 6-13 demonstrates how to configure accounting on the Cisco ASA via the CLI.
Example 6-13. Enabling Accounting by Using an ACL to Define Interesting Traffic
New York(config)# access-list 100 permit ip 10.10.1.0 255.255.255.0 10.10.2.0 255.255.255.0 New York(config)# aaa accounting match 100 inside my-radius-group
In Example 6-13, an ACL is configured to enable accounting for all connections initiated from 10.10.1.0/24 to 10.10.2.0/24. The ACL is then applied to the aaa accounting match command. A previously defined AAA server group named my-radius-group is used with this command.
You can also use the aaa accounting include | exclude command options, as demonstrated for the aaa authentication command. The aaa accounting match command makes the include and exclude options obsolete.
RADIUS Accounting
Table 6-6 lists all the RADIUS accounting messages supported by Cisco ASA.
Table 6-6. RADIUS Accounting Messages Supported in the Cisco ASA
|
Attribute |
Applicable Messages |
|
acct-authentic |
on, off, start, stop |
|
acct-delay-time |
on, off, start, stop |
|
acct-status-type |
on, off, start, stop |
|
acct-session-id |
start, stop |
|
nas-ip-address |
on, off, start, stop |
|
nas-port |
on, off, start, stop |
|
user-name |
on, off, start, stop |
|
class |
start, stop |
|
service type |
start, stop |
|
framed-protocol |
start, stop |
|
framed-ip-address |
start, stop |
|
tunnel-client-endpoint |
start, stop |
|
acct-session-time |
stop |
|
acct-input-packets |
stop |
|
acct-output-packets |
stop |
|
acct-input-octets |
stop |
|
acct-output-octets |
stop |
|
acct-terminate-cause |
stop |
|
login-ip-host |
on, off, start, stop |
|
login-port |
on, off, start, stop |
|
Cisco AV pair (used to send source addr/port and dest addr/port) |
on, off, start, stop |
|
isakmp-initiator-ip |
on, off, start, stop |
|
isakmp-phase1-id |
on, off, start, stop |
|
isakmp-group-id |
on, off, start, stop |
|
acct-input-gigawords |
stop |
|
acct-output-gigawords |
stop |
The accounting-on message marks the start of accounting services. Subsequently, to mark the end of accounting services, use the accounting-off message. The start and stop accounting records messages are used to label when a user started a connection to a specific service. These sessions are labeled with their own accounting session IDs.
TACACS+ Accounting
Table 6-7 lists all the TACACS+ accounting messages that Cisco ASA supports.
Table 6-7. TACACS+ Accounting Messages Supported by Cisco ASA
|
Attribute |
Applicable Messages |
|
username (fixed field) |
start, stop |
|
port (NAS) (fixed field) |
start, stop |
|
remote_address (fixed field) |
start, stop |
|
task_id |
start, stop |
|
foreign_IP |
start, stop |
|
local_IP |
start, stop |
|
cmd |
start, stop |
|
elapsed_time |
stop |
|
bytes_in |
stop |
|
bytes_out |
stop |
Cisco ASA also enables you to configure command accounting, depending on the user's privilege level. Use the following command to enable this feature:
aaa accounting command {privilege level} tacacs_server_tag
Example 6-14 demonstrates how to configure command accounting on the Cisco ASA, depending on the user's privilege level.
Example 6-14. Enabling Command Accounting
New York(config)# aaa accounting command privilege 15 my-tacacs-group
In Example 6-14, the accounting command is enabled for users that execute a privilege level 15 command.
Alternatively, you can configure command accounting via ASDM by navigating to Configuration > Device Management > Users/AAA > AAA Access > Accounting and selecting Enable under the Require Command Accounting for ASA section.
Troubleshooting Administrative Connections to Cisco ASA
You can authenticate administrative connections by using RADIUS, TACACS+, or the Cisco ASA local user database. The following debug commands are available to troubleshoot AAA problems when you are trying to connect to the Cisco ASA for administration:
- debug aaa—Provides information about the authentication, authorization, or accounting messages generated and received by the Cisco ASA.
-
debug radius—To troubleshoot RADIUS transactions, use this command, which has several options:
- all—Enables all debug options
- decode—Shows decoded RADIUS transaction messages
- session—Provides information about all RADIUS sessions
- user—Enables you to capture RADIUS transaction information for a specific user connection
-
debug tacacs—To troubleshoot TACACS+ transactions, use this command with either of the following options:
- session—Provides detailed information about all TACACS+ transactions
- user—Allows you to capture TACACS+ transaction information for a specific user connection
If you enter debug tacacs without any options, the debug command is enabled with the session option by default. Example 6-15 includes the output of debug tacacs during a successful Telnet authentication.
Example 6-15. Output of debug tacacs During a Successful Telnet Authentication
New York# debug tacacs mk_pkt - type: 0x1, session_id: 4user: user1Tacacs packet sent Sending TACACS Start message. Session id: 4, seq no:1 Received TACACS packet. Session id:4 seq no:2tacp_procpkt_authen: GETPASSAuthen Message: Password: mk_pkt - type: 0x1, session_id: 4 mkpkt_continue - response: *** Tacacs packet sent Sending TACACS Continue message. Session id: 4, seq no:3 Received TACACS packet. Session id:4 seq no:4tacp_procpkt_authen: PASSTACACS Session finished. Session id: 4, seq no: 3
In Example 6-15, User1 connected to the Cisco ASA via Telnet. The Cisco ASA was configured to perform authentication via an external TACACS+ server. The first highlighted line shows that User1 attempted a connection to the Cisco ASA. The second highlighted line shows the ASA requesting the user's password. The user information is sent to the TACACS+ server and is finally authenticated. The third highlighted line shows that the authentication was successful. Example 6-16 includes the output of debug tacacs during an authentication failure. In this example, the incorrect password was entered by the user and the TACACS+ server failed its authentication.
Example 6-16. Output of debug tacacs During a Failed Authentication Because of Wrong Password
New York# debug tacacs mk_pkt - type: 0x1, session_id: 5 user: user1 Tacacs packet sent Sending TACACS Start message. Session id: 5, seq no:1 Received TACACS packet. Session id:5 seq no:2 tacp_procpkt_authen: GETPASS Authen Message: Password: mk_pkt - type: 0x1, session_id: 5 mkpkt_continue - response: *** Tacacs packet sent Sending TACACS Continue message. Session id: 5, seq no:3 Received TACACS packet. Session id:5 seq no:4 tacp_procpkt_authen: FAIL TACACS Session finished. Session id: 5, seq no: 3 The highlighted line in Example 6-22 shows the authentication FAIL message.
In Example 6-17, the TACACS+ server was offline or unreachable.
Example 6-17. Output of debug tacacs While TACACS+ Server Is Unreachable
New York# debug tacacs mk_pkt - type: 0x1, session_id: 6 user: user1Tacacs packet sentSending TACACS Start message. Session id: 6, seq no:1Received TACACS packet. Session id:6 seq no:2 TACACS Request Timed out. Session id: 6, seq no:1 TACACS Session finished. Session id: 6, seq no: 1 mk_pkt - type: 0x1, session_id: 6 user: user1Tacacs packet sentSending TACACS Start message. Session id: 6, seq no:1Received TACACS packet. Session id:6 seq no:2 TACACS Request Timed out. Session id: 6, seq no:1 TACACS Session finished. Session id: 6, seq no: 1 mk_pkt - type: 0x1, session_id: 6 user: user1Tacacs packet sentSending TACACS Start message. Session id: 6, seq no:1Received TACACS packet. Session id:6 seq no:2 TACACS Request Timed out. Session id: 6, seq no:1 TACACS Session finished. Session id: 6, seq no: 1aaa server host machine not responding
The highlighted lines show how the Cisco ASA attempts to communicate with the TACACS+ server three times and finally finishes all authentication transactions. The show aaa-server command is useful while troubleshooting and monitoring authentication transactions. Example 6-18 includes the output of the show aaa-server command for all TACACS+ transactions.
Example 6-18. Monitoring and Troubleshooting TACACS+ Transactions with the show aaa-server Command
New York# show aaa-server protocol tacacs+ Server Group: mygroup Server Protocol: tacacs+ Server Address: 172.18.124.145 Server port: 49 Server status: ACTIVE, Last transaction at 21:05:43 UTC Fri March 20 2009 Number of pending requests 0 Average round trip time 43ms Number of authentication requests 4 Number of authorization requests 0 Number of accounting requests 0 Number of retransmissions 0 Number of accepts 3 Number of rejects 1 Number of challenges 4 Number of malformed responses 0 Number of bad authenticators 0 Number of timeouts 0 Number of unrecognized responses 0
In Example 6-18, the Cisco ASA processed a total of four authentication requests. Three of those requests were successfully authenticated and one was rejected by the TACACS+ server.
Troubleshooting Firewall Sessions (Cut-Through Proxy)
The techniques to troubleshoot cut-through proxy sessions on Cisco ASA are similar to those mentioned in the previous section. Additionally, the show uauth command can be used to display information about authenticated users and current transactions. Example 6-19 shows the output of this command.
Example 6-19. Output of the show uauth Command
New York# show uauth
Current Most Seen
Authenticated Users 0 0
Authen In Progress 1 3
In Example 6-19, a total of three concurrent authentication requests were processed by the Cisco ASA. One is currently being processed.