-
Cisco IOS Security Command Reference, Release 12.2 T
-
Cisco IOS Firewall Intrusion Detection System Commands
-
Kerberos Commands
-
TACACS+ Commands
-
Lock-and-Key Commands
-
Port to Application Mapping Commands
-
Reflexive Access List Commands
-
Authorization Commands
-
Internet Key Exchange Security Protocol Commands
-
Authentication Proxy Commands
-
Authentication Commands
-
Accounting Commands
-
Secure Shell Commands
-
IP Security Options Commands
-
Passwords and Privileges Commands
-
Unicast Reverse Path Forwarding Commands
-
Certification Authority Interoperability Commands
-
IPSec Network Security Commands
-
TCP Intercept Commands
-
Context-Based Access Control Commands
-
RADIUS Commands
-
SR: Index
-
Table Of Contents
aaa accounting connection h323
aaa accounting resource start-stop group
aaa accounting resource stop-failure group
aaa accounting send stop-record authentication failure
aaa accounting session-duration ntp-adjusted
aaa accounting suppress null-username
aaa dnis map accounting network
Accounting Commands
This chapter describes the commands used to manage accounting on the network. Accounting management allows you to track individual and group usage of network resources. The authentication, authorization, and accounting (AAA) accounting feature enables you to track the services users are accessing as well as the amount of network resources they are consuming. When AAA accounting is activated, the network access server reports user activity to the TACACS+ or RADIUS security server (depending on which security method you have implemented) in the form of accounting records. Each accounting record contains accounting attribute-value (AV) pairs and is stored on the security server. This data can then be analyzed for network management, client billing or auditing.
For information on how to configure accounting using AAA, refer to the chapter "Configuring Accounting" in the Cisco IOS Security Configuration Guide. For configuration examples using the commands in this chapter, refer to the section "Accounting Configuration Examples" located at the end of the chapter "Configuring Accounting" in the Cisco IOS Security Configuration Guide.
Refer also to the IP accounting feature in the chapter "Configuring IP Services" of the
Cisco IOS IP Configuration Guide.aaa accounting
To enable authentication, authorization, and accounting (AAA) accounting of requested services for billing or security purposes when you use RADIUS or TACACS+, use the aaa accounting command in global configuration mode. To disable AAA accounting, use the no form of this command.
aaa accounting {auth-proxy | system | network | exec | connection | commands level} {default | list-name} [vrf vrf-name] {start-stop | stop-only | none} [broadcast] group groupname
no aaa accounting {auth-proxy | system | network | exec | connection | commands level} {default | list-name} [vrf vrf-name] [broadcast] group groupname
Syntax Description
auth-proxy
Provides information about all authenticated-proxy user events.
system
Performs accounting for all system-level events not associated with users, such as reloads.
network
Runs accounting for all network-related service requests, including Serial Line Internet Protocol (SLIP), PPP, PPP Network Control Protocols (NCPs), and AppleTalk Remote Access Protocol (ARAP).
exec
Runs accounting for EXEC shell session. This keyword might return user profile information such as what is generated by the autocommand command.
connection
Provides information about all outbound conections made from the network access server, such as Telnet, local-area transport (LAT), TN3270, packet assembler and disassembler (PAD), and rlogin.
commands level
Runs accounting for all commands at the specified privilege level. Valid privilege level entries are integers from 0 through 15.
default
Uses the listed accounting methods that follow this argument as the default list of methods for accounting services.
list-name
Character string used to name the list of at least one of the accounting methods described in Table 8.
vrf vrf-name
(Optional) Specifies a Virtual Route Forwarding (VRF) configuration.
Note
VRF is used only with system accounting.
start-stop
Sends a "start" accounting notice at the beginning of a process and a "stop" accounting notice at the end of a process. The "start" accounting record is sent in the background. The requested user process begins regardless of whether the "start" accounting notice was received by the accounting server.
stop-only
Sends a "stop" accounting notice at the end of the requested user process.
none
Disables accounting services on this line or interface.
broadcast
(Optional) Enables sending accounting records to multiple AAA servers. Simultaneously sends accounting records to the first server in each group. If the first server is unavailable, fail over occurs using the backup servers defined within that group.
group group-name
At least one of the keywords described in Table 8.
Defaults
AAA accounting is disabled.
Command Modes
Global configuration
Command History
Usage Guidelines
Use the aaa accounting command to enable accounting and to create named method lists that define specific accounting methods on a per-line or per-interface basis.
Table 8 contains descriptions of keywords for aaa accounting methods.
In Table 8, the group radius and group tacacs+ methods refer to a set of previously defined RADIUS or TACACS+ servers. Use the radius-server host and tacacs-server host commands to configure the host servers. Use the aaa group server radius and aaa group server tacacs+ commands to create a named group of servers.
Cisco IOS software supports the following two methods of accounting:
•
•
Method lists for accounting define the way accounting will be performed. Named accounting method lists enable you to designate a particular security protocol to be used on specific lines or interfaces for particular types of accounting services. Create a list by entering the list-name and the method, where list-name is any character string used to name this list (excluding the names of methods, such as radius or tacacs+) and method identifies the methods to be tried in sequence as given.
If the aaa accounting command for a particular accounting type is issued without a named method list specified, the default method list is automatically applied to all interfaces or lines (where this accounting type applies) except those that have a named method list explicitly defined. (A defined method list overrides the default method list.) If no default method list is defined, then no accounting takes place.
Named accounting method lists are specific to the indicated type of accounting. Method list keywords are described in Table 9.
Note
For minimal accounting, include the stop-only keyword to send a "stop" record accounting notice at the end of the requested user process. For more accounting, you can include the start-stop keyword, so that RADIUS or TACACS+ sends a "start" accounting notice at the beginning of the requested process and a "stop" accounting notice at the end of the process. Accounting is stored only on the RADIUS or TACACS+ server. The none keyword disables accounting services for the specified line or interface.
To specify an accounting configuration for a particular virtual route forwarding (VRF), specify a default system accounting method list, and use the vrf keyword and vrf-name argument. System accounting does not have knowledge of VRF unless specified.
When AAA accounting is activated, the network access server monitors either RADIUS accounting attributes or TACACS+ AV pairs pertinent to the connection, depending on the security method you have implemented. The network access server reports these attributes as accounting records, which are then stored in an accounting log on the security server. For a list of supported RADIUS accounting attributes, refer to the appendix "RADIUS Attributes Overview" in the Cisco IOS Security Configuration Guide, Release 12.2. For a list of supported TACACS+ accounting AV pairs, refer to the appendix "TACACS+ Attribute-Value Pairs" in the Cisco IOS Security Configuration Guide, Release 12.2.
Note
Examples
The following example defines a default commands accounting method list, where accounting services are provided by a TACACS+ security server, set for privilege level 15 commands with a stop-only restriction.
aaa accounting commands 15 default stop-only group tacacs+The following example defines a default auth-proxy accounting method list, where accounting services are provided by a TACACS+ security server with a start-stop restriction. The aaa accounting command activates authentication proxy accounting.
aaa new-modelaaa authentication login default group tacacs+aaa authorization auth-proxy default group tacacs+aaa accounting auth-proxy default start-stop group tacacs+The following example defines a default system accounting method list, where accounting services are provided by RADIUS security server "sg_water" with a start-stop restriction. The aaa accounting command specifies accounting for vrf "water."
aaa accounting system default vrf water start-stop group sg_waterRelated Commands
aaa accounting connection h323
To define the accounting method list H.323with RADIUS as a method with either stop-only or start-stop accounting options, use the aaa accounting connection h323 command in global configuration mode. To disable the use of this accounting method list, use the no form of this command.
aaa accounting connection h323 {stop-only | start-stop | none} [broadcast] group groupname
no aaa accounting connection h323 {stop-only | start-stop | none} [broadcast] group groupname
Syntax Description
Defaults
No accounting method list
Command Modes
Global configuration
Command History
Usage Guidelines
This command creates a method list called h323 and is applied by default to all voice interfaces if the gw-accounting h323 command is also activated.
Examples
The following example enables authentication, authorization, and accounting (AAA) services, gateway accounting services, and defines a connection accounting method list (h323). The h323 accounting method lists specifies that RADIUS is the security protocol that will provide the accounting services, and that the RADIUS service will track start-stop records.
aaa new modelgw-accounting h323aaa accounting connection h323 start-stop radiusaaa accounting delay-start
To delay generation of accounting "start" records until the user IP address is established, use the aaa accounting delay-start command in global configuration mode. To disable this functionality, use the no form of this command.
aaa accounting delay-start [vrf vrf-name]
no aaa accounting delay-start [vrf vrf-name]
Syntax Description
Defaults
Accounting records are not delayed.
Command Modes
Global configuration
Command History
Usage Guidelines
Use the aaa accounting delay-start command to delay generation of accounting "start" records until the IP address of the user has been established. Use the vrf vrf-name keyword and argument to delay accounting "start" records per Virtual Private Network (VPN) routing and forwarding (VRF) configuration.
Examples
The following example shows how to delay accounting "start" records until the IP address of the user is established:
aaa new-modelaaa authentication ppp default radiusaaa accounting network default start-stop radiusaaa accounting delay-startradius-server host 172.16.0.0 non-standardradius-server key rad123Related Commands
aaa accounting gigawords
To enable authentication, authorization, and accounting (AAA) 64-bit, high-capacity counters, use the aaa accounting gigawords command in global configuration mode. To disable the counters, use the no form of this command. (Note that gigaword support is automatically configured unless you unconfigure it using the no form of the command.)
aaa accounting gigawords
no aaa accounting gigawords
Syntax Description
This command has no arguments or keywords.
Defaults
If this command is not configured, the 64-bit, high-capacity counters that support RADIUS attributes 52 and 53 are automatically enabled.
Command Modes
Global configuration
Command History
Usage Guidelines
The AAA high-capacity counter process takes approximately 8 percent CPU memory for 24,000 (24 K) sessions running under steady state.
If you have entered the no form of this command to turn off the 64-bit counters and you want to reenable them, you will need to enter the aaa accounting gigawords command. Also, once you have entered the no form of the command, it takes a reload of the router to actually disable the use of the 64-bit counters.
Note
Examples
The following example shows that the AAA 64-bit counters have been disabled:
no aaa accounting gigawordsaaa accounting nested
To specify that NETWORK records be generated, or nested, within EXEC "start" and "stop" records for PPP users who start EXEC terminal sessions, use the aaa accounting nested command in global configuration mode. To allow the sending of records for users with a NULL username, use the no form of this command.
aaa accounting nested
no aaa accounting nested
Syntax Description
This command has no arguments or keywords.
Defaults
Disabled
Command Modes
Global configuration
Command History
Usage Guidelines
Use this command when you want to specify that NETWORK records be nested within EXEC "start" and "stop" records, such as for PPP users who start EXEC terminal sessions. In some cases, such as billing customers for specific services, is can be desirable to keep NETWORK "start" and "stop" records together, essentially nesting them within the framework of the EXEC "start" and "stop" messages. For example, a user dialing in using PPP can create the following records: EXEC-start, NETWORK-start, EXEC-stop, NETWORK-stop. By nesting the accounting records, NETWORK-stop records follow NETWORK-start messages: EXEC-start, NETWORK-start, NETWORK-stop, EXEC-stop.
Examples
The following example enables nesting of NETWORK accounting records for user sessions:
aaa accounting nestedaaa accounting resource start-stop group
To enable full resource accounting, which will generate both a "start" record at call setup and a "stop" record at call termination, use the aaa accounting resource start-stop group command in global configuration mode. To disable full resource accounting, use the no form of this command.
aaa accounting resource method-list start-stop [broadcast] group groupname
no aaa accounting resource method-list start-stop [broadcast] group groupname
Syntax Description
Defaults
No default behavior or values.
Command Modes
Global configuration
Command History
Usage Guidelines
Use the aaa accounting resource start-stop group command to send a "start" record at each call setup followed with a corresponding "stop" record at the call disconnect. There is a separate "call setup-call disconnect "start-stop" accounting record tracking the progress of the resource connection to the device, and a separate "user authentication start-stop accounting" record tracking the user management progress. These two sets of accounting records are interlinked by using a unique session ID for the call.
You may want to use this command to manage and monitor wholesale customers from one source of data reporting, such as accounting records.
Note
All existing AAA accounting method list and server group options are made available to this command.
Examples
The following example shows how to configure resource accounting for "start-stop" records:
aaa new-modelaaa authentication login AOL group radius localaaa authentication ppp default group radius localaaa authorization exec AOL group radius if-authenticatedaaa authorization network default group radius if-authenticatedaaa accounting exec default start-stop group radiusaaa accounting network default start-stop group radiusaaa accounting resource default start-stop group radiusRelated Commands
aaa accounting resource stop-failure group
To enable resource failure stop accounting support, which will generate a "stop" record at any point prior to user authentication only if a call is terminated, use the aaa accounting resource stop-failure group command in global configuration mode. To disable resource failure stop accounting, use the no form of this command.
aaa accounting resource method-list stop-failure [broadcast] group groupname
no aaa accounting resource method-list stop-failure [broadcast] group groupname
Syntax Description
Defaults
No default behavior or values.
Command Modes
Global configuration
Command History
Usage Guidelines
Use the aaa accounting resource stop-failure group command to generate a "stop" record for any calls that do not reach user authentication; this function creates "stop" accounting records for the moment of call setup. All calls that pass user authentication will behave as before; that is, no additional accounting records will be seen.
All existing authentication, authorization, and accounting (AAA) accounting method list and server group options are made available to this command.
Examples
The following example shows how to configure "stop" accounting records from the moment of call setup:
aaa new-modelaaa authentication login AOL group radius localaaa authentication ppp default group radius localaaa authorization exec AOL group radius if-authenticatedaaa authorization network default group radius if-authenticatedaaa accounting exec default start-stop group radiusaaa accounting network default start-stop group radiusaaa accounting resource default stop-failure group radiusRelated Commands
aaa accounting resource start-stop group
Enables full resource accounting, which will generate both a "start" record at call setup and a "stop" record at call termination.
aaa accounting send stop-record authentication failure
To generate accounting "stop" records for users who fail to authenticate at login or during session negotiation, use the aaa accounting send stop-record authentication failure command in global configuration mode. To stop generating records for users who fail to authenticate at login or during session negotiation, use the no form of this command.
aaa accounting send stop-record authentication failure [vrf vrf-name]
no aaa accounting send stop-record authentication failure
Syntax Description
Defaults
The "stop" records are not generated.
Command Modes
Global configuration
Command History
Usage Guidelines
Use this command to generate accounting "stop" records for users who fail to authenticate at login or during session negotiation. When the aaa accounting command is activated, by default the Cisco IOS software does not generate accounting records for system users who fail login authentication or who succeed in login authentication but fail PPP negotiation for some reason.
Use the vrf vrf-name keyword and argument to generate accounting "stop" records per Virtual Private Network (VPN) routing and forwarding (VRF) configuration.
Examples
The following example shows how to generate "stop" records for users who fail to authenticate at login or during session negotiation:
aaa accounting send stop-record authentication failureaaa accounting session-duration ntp-adjusted
To calculate RADIUS attribute 46, Acct-Sess-Time, on the basis of the Network Time Protocol (NTP) clock time, use the aaa accounting session-duration ntp-adjusted command in global configuration mode. To disable the calculation that was configured on the basis of the NTP clock time, use the no form of this command.
aaa accounting session-duration ntp-adjusted
no aaa accounting session-duration ntp-adjusted
Syntax Description
This command has no arguments or keywords.
Defaults
If this command is not configured, RADIUS attribute 46 is calculated on the basis of the 64-bit monotonically increasing counter, which is not NTP adjusted.
Command Modes
Global configuration
Command History
Usage Guidelines
If this command is not configured, RADIUS attribute 46 can skew the session time by as much as 5 to 7 seconds for calls that have a duration of more than 24 hours. However, you may not want to configure the command for short-lived calls or if your device is up for only a short time because of the convergence time required if the session time is configured on the basis of the NTP clock time.
For RADIUS attribute 46 to reflect the NTP-adjusted time, you must configure the ntp server command as well as the aaa accounting session-duration ntp-adjusted command.
Examples
The following example shows that the attribute 46 session time is to be calculated on the basis of the NTP clock time:
aaa new-modelaaa authentication ppp default group radiusaaa accounting session-time ntp-adjustedaaa accounting network default start-stop group radiusRelated Commands
aaa accounting suppress null-username
To prevent the Cisco IOS software from sending accounting records for users whose username string is NULL, use the aaa accounting suppress null-username command in global configuration mode. To allow sending records for users with a NULL username, use the no form of this command.
aaa accounting suppress null-username
no aaa accounting suppress null-username
Syntax Description
This command has no arguments or keywords.
Defaults
Disabled
Command Modes
Global configuration
Command History
Usage Guidelines
When aaa accounting is activated, the Cisco IOS software issues accounting records for all users on the system, including users whose username string, because of protocol translation, is NULL. This command prevents accounting records from being generated for those users who do not have usernames associated with them.
Examples
The following example supresses accounting records for users who do not have usernames associated with them:
aaa accounting suppress null-usernameRelated Commands
aaa accounting update
To enable periodic interim accounting records to be sent to the accounting server, use the aaa accounting update command in global configuration mode. To disable interim accounting updates, use the no form of this command.
aaa accounting update [newinfo] [periodic number [jitter {maximum max-value}]]
no aaa accounting update
Syntax Description
Defaults
Disabled
Command Modes
Global configuration
Command History
Usage Guidelines
•
•
•
•
•
•
Caution
Examples
The following example sends PPP accounting records to a remote RADIUS server. When IPCP completes negotiation, this command sends an interim accounting record to the RADIUS server that includes the negotiated IP address for this user; it also sends periodic interim accounting records to the RADIUS server at 30-minute intervals.
aaa accounting network default start-stop group radiusaaa accounting update newinfo periodic 30The following example sends periodic interim accounting records to the RADIUS server at 30-minute intervals and disables jitter:
aaa accounting update newinfo periodic 30 jitter maximum 0Related Commands
aaa accounting
Enables AAA accounting of requested services for billing or security purposes.
gw-accounting aaa
Enables VoIP gateway accounting through the AAA system.
aaa dnis map accounting network
To map a Dialed Number Information Service (DNIS) number to a particular authentication, authorization, and accounting (AAA) server group that will be used for AAA accounting, use the aaa dnis map accounting network command in global configuration mode. To remove DNIS mapping from the named server group, use the no form of this command.
aaa dnis map dnis-number accounting network [start-stop | stop-only | none] [broadcast] group groupname
no aaa dnis map dnis-number accounting network
Syntax Description
dnis-number
Number of the DNIS.
start-stop
(Optional) Indicates that the defined security server group will send a "start accounting" notice at the beginning of a process and a "stop accounting" notice at the end of a process. The "start accounting" record is sent in the background. (The requested user process begins regardless of whether the "start accounting" notice was received by the accounting server.)
stop-only
(Optional) Indicates that the defined security server group will send a "stop accounting" notice at the end of the requested user process.
none
(Optional) Indicates that the defined security server group will not send accounting notices.
broadcast
(Optional) Enables sending accounting records to multiple AAA servers. Simultaneously sends accounting records to the first server in each group. If the first server is unavailable, failover occurs using the backup servers defined within that group.
group groupname
At least one of the keywords described in Table 10.
Defaults
This command is disabled by default.
Command Modes
Global configuration
Command History
Usage Guidelines
This command lets you assign a DNIS number to a particular AAA server group so that the server group can process accounting requests for users dialing in to the network using that particular DNIS. To use this command, you must first enable AAA, define an AAA server group, and enable DNIS mapping.
Table 10 contains descriptions of accounting method keywords.
In Table 10, the group radius and group tacacs+ methods refer to a set of previously defined RADIUS or TACACS+ servers. Use the radius-server host and tacacs+-server host commands to configure the host servers. Use the aaa group server radius and aaa group server tacacs+ commands to create a named group of servers.
Examples
The following example maps DNIS number 7777 to the RADIUS server group called group1. Server group group1 will use RADIUS server 172.30.0.0 for accounting requests for users dialing in with DNIS 7777.
aaa new-modelradius-server host 172.30.0.0 acct-port 1646 key cisco1aaa group server radius group1server 172.30.0.0aaa dnis map enableaaa dnis map 7777 accounting network group group1Related Commands
aaa session-id
To specify whether the same session ID will be used for each authentication, authorization, and accounting (AAA) accounting service type within a call or whether a different session ID will be assigned to each accounting service type, use the aaa session-id command in global configuration mode. To restore the default behavior after the unique keyword is enabled, use the no form of this command.
aaa session-id [common | unique]
no aaa session-id [unique]
Syntax Description
Defaults
The common keyword is enabled.
Command Modes
Global configuration
Command History
12.2(4)B
This command was introduced.
12.2(8)T
This command was integrated into Cisco IOS Release 12.2(8)T.
Usage Guidelines
The common keyword behavior allows the first session ID request of the call to be stored in a common database; all proceeding session ID requests will retrieve the value of the first session ID. Because a common session ID is the default behavior, this functionality is written to the system configuration after the aaa new-model command is configured.
Note
The unique keyword behavior assigns a different session ID for each accounting type (Auth-Proxy, Exec, Network, Command, System, Connection, and Resource) during a call. To specify this behavior, the unique keyword must be specified. The session ID may be included in RADIUS access requests by configuring the radius-server attribute 44 include-in-access-req command. The session ID in the access-request will be the same as the session ID in the accounting request for the same service; all other services will provide unique session IDs for the same call.
Examples
The following example shows how to configure unique session IDs:
aaa new-modelaaa authentication ppp default group radiusradius-server host 10.100.1.34radius-server attribute 44 include-in-access-reqaaa session-id uniqueRelated Commands
aaa session-mib
To enable disconnect by using Simple Network Management Protocol (SNMP), use the aaa session-mib global configuration mode command. To disable this function, use the no form of this command.
aaa session-mib disconnect
no aaa session-mib disconnect
Syntax Description
Defaults
No default behavior or values.
Command Modes
Global configuration
Command History
Usage Guidelines
Use the aaa session-mib command to terminate authenticated client connections using SNMP.
You must enable the disconnect keyword with this command. Otherwise, the network management station cannot perform set operations and disconnect users; it can only poll the table.
Examples
The following example shows how to enable a AAA session MIB to disconnect authenticated clients using SNMP:
aaa session-mib disconnect
accounting
To enable authentication, authorization, and accounting (AAA) accounting services to a specific line or group of lines, use the accounting command in line configuration mode. To disable AAA accounting services, use the no form of this command.
accounting {arap | commands level | connection | exec} [default | list-name]
no accounting {arap | commands level | connection | exec} [default | list-name]
Syntax Description
Defaults
Accounting is disabled.
Command Modes
Line configuration
Command History
Usage Guidelines
After you enable the aaa accounting command and define a named accounting method list (or use the default method list) for a particular type of accounting, you must apply the defined lists to the appropriate lines for accounting services to take place. Use the accounting command to apply the specified method lists (or if none is specified, the default method list) to the selected line or group of lines.
Examples
The following example enables command accounting services (for level 15) using the accounting method list named charlie on line 10:
line 10accounting commands 15 charlieRelated Commands
accounting (gatekeeper)
To enable accounting services on the gatekeeper, use the accounting command in gatekeeper configuration mode. To disable accounting services, use the no form of this command.
accounting [vsa]
no accounting [vsa]
Syntax Description
Defaults
Accounting is disabled.
Command Modes
Gatekeeper configuration
Command History
Usage Guidelines
Specify a RADIUS server before using the accounting command.
There are three different methods of accounting. The H.323 method sends the call detail record (CDR) to the RADIUS server, the syslog method uses the system logging facility to record the CDRs, and the VSA method collects VSAs.
Examples
The following example enables the gateway to report user activity to the RADIUS server in the form of connection accounting records:
aaa accounting connection start-stop group radiusgatekeeperaccountingThe following example shows how to enable VSA accounting:
aaa accounting connection start-stop group radiusgatekeeperaccounting exec vsaRelated Commands
ppp accounting
To enable authentication, authorization, and accounting (AAA) accounting services on the selected interface, use the ppp accounting command in interface configuration mode. To disable AAA accounting services, use the no form of this command.
ppp accounting default
no ppp accounting
Syntax Description
Defaults
Accounting is disabled.
Command Modes
Interface configuration
Command History
Usage Guidelines
After you enable the aaa accounting command and define a named accounting method list (or use the default method list), you must apply the defined lists to the appropriate interfaces for accounting services to take place. Use the ppp accounting command to apply the specified method lists (or if none is specified, the default method list) to the selected interface.
Examples
The following example enables accounting on asynchronous interface 4 and uses the accounting method list named charlie:
interface async 4encapsulation pppppp accounting charlieRelated Commands
show aaa user
To display attributes related to an authentication, authorization, and accounting (AAA) session, use the show aaa user command in privileged EXEC mode.
show aaa user {all | unique id}
Syntax Description
all
Displays information about all users for which AAA currently has knowledge.
unique id
Displays information for only this user.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
When a user logs into a Cisco router and uses AAA, a unique ID is assigned to the session. Throughout the life of the session, various attributes that are related to the session are collected and stored internally within a AAA database. These attributes can include the IP address of the user, the protocol being used to access the router (such as PPP or Serial Line Internet Protocol [SLIP]), the speed of the connection, and the number of packets or bytes that are received or transmitted.
The output of this command provides a snapshot of various subdatabases that are associated with a AAA unique ID. Some of the more important ones are listed in Table 11.
The output also shows various AAA call events that are associated with a particular session. For example, when a session comes up, the events generally recorded are CALL START, NET UP, and IP Control Protocol UP (IPCP UP).
In addition, the output provides a snapshot of the dynamic attributes that are associated with a particular session. (Dynamic attributes are those that keep changing values throughout the life of the session.) Some of the more important ones are listed in Table 11.
The unique ID of a session can be obtained from the output of the show aaa sessions command.
Note
Note
Examples
The following example shows that information is requested for all users:
Router# show aaa user allThe following example shows that information is requested for user 5:
Router# show aaa user 5The following is sample output from the show aaa user command. The session information displayed is for a PPP over Ethernet over Ethernet (PPPoEoE) session.
Router# show aaa user 3Load for five secs: 0%/0%; one minute: 0%; five minutes: 0%Time source is hardware calendar, *20:32:49.199 PST Wed Dec 172003Unique id 3 is currently in use.Accounting:log=0x20C201Events recorded :CALL STARTNET UPIPCP_PASSINTERIM STARTVPDN NET UPupdate method(s) :NONEupdate interval = 0Outstanding Stop Records : 0Dynamic attribute list:63CCF138 0 00000001 connect-progress(30) 4 LAN Ses Up63CCF14C 0 00000001 pre-session-time(239) 4 3(3)63CCF160 0 00000001 nas-tx-speed(337) 4 102400000(61A8000)63CCF174 0 00000001 nas-rx-speed(33) 4 102400000(61A8000)63CCF188 0 00000001 elapsed_time(296) 4 2205(89D)63CCF19C 0 00000001 bytes_in(97) 4 6072(17B8)63CCF1B0 0 00000001 bytes_out(223) 4 6072(17B8)63CCF1C4 0 00000001 pre-bytes-in(235) 4 86(56)63CCF1D8 0 00000001 pre-bytes-out(236) 4 90(5A)63CCF1EC 0 00000001 paks_in(98) 4 434(1B2)63CCF244 0 00000001 paks_out(224) 4 434(1B2)63CCF258 0 00000001 pre-paks-in(237) 4 7(7)63CCF26C 0 00000001 pre-paks-out(238) 4 9(9)No data for type EXECNo data for type CONNNET: Username=peer1Session Id=00000003 Unique Id=00000003Start Sent=1 Stop Only=Nstop_has_been_sent=NMethod List=63B4A10C : Name = defaultAttribute list:63CCF138 0 00000001 session-id(293) 4 3(3)63CCF14C 0 00000001 Framed-Protocol(62) 4 PPP63CCF160 0 00000001 protocol(241) 4 ip63CCF174 0 00000001 addr(5) 4 70.0.0.1No data for type CMDNo data for type SYSTEMNo data for type RM CALLNo data for type RM VPDNNo data for type AUTH PROXYNo data for type IPSEC-TUNNELNo data for type RESOURCENo data for type 10No data for type CALLDebg: No data availableRadi: 641AACACInterface:TTY Num = -1Stop Received = 0Byte/Packet Counts till Call Start:Start Bytes In = 106 Start Bytes Out = 168Start Paks In = 3 Start Paks Out = 4Byte/Packet Counts till Service Up:Pre Bytes In = 192 Pre Bytes Out = 258Pre Paks In = 10 Pre Paks Out = 13Cumulative Byte/Packet Counts :Bytes In = 6264 Bytes Out = 6330Paks In = 444 Paks Out = 447StartTime = 19:56:01 PST Dec 17 2003AuthenTime = 19:56:04 PST Dec 17 2003Component = PPoEAuthen: service=PPP type=CHAP method=RADIUSKerb: No data availableMeth: No data availablePreauth: No Preauth data.General:Unique Id = 00000003Session Id = 00000003Attribute List:63CCF180 0 00000001 port-type(156) 4 PPP over Ethernet63CCF194 0 00000009 interface(152) 7 0/0/0/0PerU: No data availableTable 11 lists the significant fields shown in the display.
Table 11 show aaa user Field Descriptions
Related Commands
show aaa sessions
Displays information about AAA sessions as seen in the AAA Session MIB.
show accounting
To step through all active sessions and to print all the accounting records for actively accounted functions, use the show accounting command in privileged EXEC mode.
show accounting
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
11.1
This command was introduced.
12.2(4)T
This command was replaced by the show aaa user command.
Usage Guidelines
The show accounting command allows you to display the active accountable events on the network. It provides system administrators with a quick look at what is going on, and it also can help collect information in the event of a data loss on the accounting server.
The show accounting command displays additional data on the internal state of authentication, authorization, and accounting (AAA) if debug aaa accounting is activated.
Examples
The following is sample output from the show accounting command:
Router# show accountingActive Accounted actions on Interface Serial0:19, User jdoe Priv 1Task ID 15, Network Accounting record, 00:00:18 Elapsedtask_id=15 timezone=PDT service=ppp mlp-links-max=4 mlp-links-current=4protocol=ip addr=209.165.200.225 mlp-sess-id=1Active Accounted actions on Interface Serial0:20, User jdoe Priv 1Task ID 13, Network Accounting record, 00:00:49 Elapsedtask_id=13 timezone=PDT service=ppp mlp-links-max=4 mlp-links-current=4protocol=ip addr=209.165.200.225 mlp-sess-id=1Active Accounted actions on Interface Serial0:21, User jdoe Priv 1Task ID 11, Network Accounting record, 00:01:19 Elapsedtask_id=11 timezone=PDT service=ppp mlp-links-max=4 mlp-links-current=4protocol=ip addr=209.165.200.225 mlp-sess-id=1Active Accounted actions on Interface Serial0:22, User jdoe Priv 1Task ID 9, Network Accounting record, 00:01:20 Elapsedtask_id=9 timezone=PDT service=ppp mlp-links-max=4 mlp-links-current=4mlp-sess-id=1 protocol=ip addr=209.165.200.225Active Accounted actions on , User (not logged in) Priv 0Task ID 1, Resource-management Accounting record, 06:21:47 Elapsedtask_id=1 timezone=PDT rm-protocol-version=1.0service=resource-managementprotocol=nas-status event=nas-start reason=reloadOverall Accounting TrafficStarts Stops Updates Active DropsExec 0 0 0 0 0Network 8 4 0 4 0Connect 0 0 0 0 0Command 0 0 0 0 0Rsrc-mgmt 1 0 0 1 0System 0 0 0 0 0User creates:21, frees:9, Acctinfo mallocs:15, frees:6Users freed with accounting unaccounted for:0Queue length:0Table 2 describes the fields contained in this display.
Related Commands
