IEEE 802.1X RADIUS Accounting
Download this chapter
IEEE 802.1X RADIUS AccountingIEEE 802.1X RADIUS Accounting
 Feedback

Contents

IEEE 802.1X RADIUS Accounting

Last Updated: July 17, 2012

The IEEE 802.1X RADIUS Accounting feature is used to relay important events to the RADIUS server (such as the supplicant's connection session). The information in these events is used for security and billing purposes.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the Feature Information Table at the end of this document.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.

Prerequisites for Configuring IEEE 802.1X RADIUS Accounting

The following tasks must be completed before implementing the IEEE 802.1X RADIUS Accounting feature:

  • IEEE 802.1X must be enabled on the device port.
  • The device must have a RADIUS configuration and be connected to the Cisco secure access control server (ACS). You should understand the concepts of the RADIUS protocol and have an understanding of how to create and apply access control lists (ACLs).
  • EAP support must be enabled on the RADIUS server.
  • You must configure the IEEE 802.1X supplicant to send an EAP-logoff (Stop) message to the switch when the user logs off. If you do not configure the IEEE 802.1X supplicant, an EAP-logoff message is not sent to the switch and the accompanying accounting Stop message is not sent to the authentication server. See the Microsoft Knowledge Base article at the location http://support.microsoft.com and set the SupplicantMode registry to 3 and the AuthMode registry to 1.
  • Authentication, authorization, and accounting (AAA) must be configured on the port for all network-related service requests. The authentication method list must be enabled and specified. A method list describes the sequence and authentication method to be queried to authenticate a user. See the IEEE 802.1X Authenticator feature module for information.
  • The port must be successfully authenticated.
  • If you plan to implement system-wide accounting, you should also configure IEEE 802.1X accounting. You also need to inform the accounting server of the system reload event when the system is reloaded to ensure that the accounting server is aware that all outstanding IEEE 802.1X sessions on this system are closed.

The RADIUS Accounting feature is available only on Cisco 800, 870, 1800, 2800, and 3800 series integrated switching routers (ISRs) that support switch ports.

The fixed-configuration Cisco 1800 series router platforms and the Cisco 870 series routers have integrated 4-port and 8-port switches.

The following cards or modules support switch ports:

  • High-speed WAN interface cards (HWICs):
    • HWIC-4ESW
    • HWICD-9ESW
  • EtherSwitch Network Modules:
    • NM-16ESW
    • NMD-36ESW

Note
Not all Cisco ISR routers support all the components listed. For information about module compatibility with a specific router platform, see Cisco EtherSwitch Modules Comparison.

To determine whether your router has switch ports that can be configured with the IEEE 802.1X port-based authentication feature, use the show interfaces switchport command.

Restrictions for IEEE 802.1X with RADIUS Accounting

  • The IEEE 802.1X with RADIUS Accounting feature is available only on a Cisco ISR switch port.
  • This feature does not support standard ACLs on the switch port.

Information About IEEE 802.1X with RADIUS Accounting

Relaying of IEEE 802.1X RADIUS Accounting Events

IEEE 802.1X RADIUS accounting relays important events to the RADIUS server (such as the supplicant's connection session). This session is defined as the interval beginning when the supplicant is authorized to use the port and ending when the supplicant stops using the port.

After the supplicant is authenticated, the switch sends accounting-request packets to the RADIUS server, which responds with accounting-response packets to acknowledge the receipt of the request.

A RADIUS accounting-request packet contains one or more Attribute-Value (AV) pairs to report various events and related information to the RADIUS server. The following events are tracked:

  • User successfully authenticates.
  • User logs off.
  • Link-down occurs on an IEEE 802.1X port.
  • Reauthentication succeeds.
  • Reauthentication fails.

When the port state transitions between authorized and unauthorized, the RADIUS messages are transmitted to the RADIUS server.

The switch does not log any accounting information. Instead, it sends such information to the RADIUS server, which must be configured to log accounting messages.

The following is the IEEE 802.1X RADIUS accounting process:

  1. A user connects to a port on the router.
  2. Authentication is performed.
  3. VLAN assignment is enabled, as appropriate, based on the RADIUS server configuration.
  4. The router sends a start message to an accounting server.
  5. Reauthentication is performed, as necessary.
  6. The port sends an interim accounting update to the accounting server that is based on the result of reauthentication.
  7. The user disconnects from the port.
  8. The router sends a stop message to the accounting server.

The switch port does not log IEEE 802.1X accounting information. Instead, it sends this information to the RADIUS server, which must be configured to log accounting messages.

To configure IEEE 802.1X accounting, you need to perform the following tasks:

Note
See the "Enabling 802.1X Accounting" section for more specific configuration information.
  • Enable accounting in your RADIUS server.
  • Enable IEEE 802.1X accounting on your switch.
  • Enable AAA accounting.

Enabling AAA system accounting along with IEEE 802.1X accounting allows system reload events to be sent to the accounting RADIUS server for logging. When the accounting RADIUS server receives notice of a system reload event, the server can infer that all active IEEE 802.1X sessions are appropriately closed.

Because RADIUS uses the unreliable transport protocol UDP, accounting messages may be lost due to poor network conditions. If the switch does not receive the accounting response message from the RADIUS server after a configurable number of retransmissions of an accounting request, the following system message appears: 

Accounting message %s for session %s failed to receive Accounting Response.

When the stop message is not transmitted successfully, a message like the following appears: 

00:09:55: %RADIUS-3-NOACCOUNTINGRESPONSE: Accounting message Start for session 172.20.50.145 sam 11/06/03 07:01:16 11000002 failed to receive Accounting Response.

Note
Use the debug radius command or debug radius accounting command to enable the %RADIUS-3-NO ACCOUNTING RESPONSE message.

Use the show radius statistics command to display the number of RADIUS messages that do not receive the accounting response message.

IEEE 802.1X Accounting Attribute-Value Pairs

The information sent to the RADIUS server is represented in the form of AV pairs. These AV pairs provide data for different applications. (For example, a billing application might require information that is in the Acct-Input-Octets or the Acct-Output-Octets attributes of a RADIUS packet.)

AV pairs are automatically sent by a router that is configured for IEEE 802.1X accounting. Three types of RADIUS accounting packets are sent by a router:

  • START-sent when a new user session starts
  • INTERIM-sent during an existing session for updates
  • STOP-sent when a session terminates

The following table lists the AV pairs and when they are sent by the router.


Note
The Framed-IP-Address AV pair (Attribute 8) is sent only if a valid Dynamic Host Control Protocol (DHCP) binding exists for the host in the DHCP snooping bindings table.
Table 1Accounting AV Pairs

Attribute Number

AV Pair Name

START

INTERIM

STOP

Attribute [1]

User-Name

Always

Always

Always

Attribute [4]

NAS-IP-Address

Always

Always

Always

Attribute [5]

NAS-Port

Always

Always

Always

Attribute [6]

Service-Type

Always

Always

Always

Attribute [8]

Framed-IP-Address

Never

Sometimes

Sometimes 1

Attribute [25]

Class

Always

Always

Always

Attribute [30]

Called-Station-ID

Always

Always

Always

Attribute [31]

Calling-Station-ID

Always

Always

Always

Attribute [40]

Acct-Status-Type

Always

Always

Always

Attribute [41]

Acct-Delay-Time

Always

Always

Always

Attribute [42]

Acct-Input-Octets

Never

Always

Always

Attribute [43]

Acct-Output-Octets

Never

Always

Always

Attribute [44]

Acct-Session-ID

Always

Always

Always

Attribute [45]

Acct-Authentic

Always

Always

Always

Attribute [46]

Acct-Session-Time

Never

Never

Always

Attribute [47]

Acct-Input-Packets

Never

Always

Always

Attribute [48]

Acct-Output-Packets

Never

Always

Always

Attribute [49]

Acct-Terminate-Cause

Never

Never

Always

Attribute [61]

NAS-Port-Type

Always

Always

Always

You can configure the ISR to send Cisco vendor-specific attributes (VSAs) to the RADIUS server. The following table lists the available Cisco AV pairs.


Note
Before VSAs can be sent in the accounting records you must configure the radius-server vsa send accounting command.
Table 2Cisco Vendor-Specific Attributes

Attribute Number

AV Pair Name

START

INTERIM

STOP

Attribute [26,9,1]

Cisco-Avpair: connect-progress

Always

Always

Always

Attribute [26,9,2]

cisco-nas-port

Always

Always

Always

Attribute [26,9,1]

Cisco-Avpair: disc-cause

Never

Never

Always

You can display the AV pairs that are being sent by the router by entering the debug radius accounting privileged EXEC command. For more information about this command, see the Cisco IOS Debug Command Reference. For more information about AV pairs, see Cisco IOS RFC 3580, IEEE 802.1X Remote Authentication Dial In User Service (RADIUS) Usage Guidelines.

How to Use IEEE 802.1X RADIUS Accounting

Enabling 802.1X RADIUS Accounting

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    aaa new-model

4.    radius-server host {hostname | ip-address} auth-port port-number acct-port port-number

5.   aaa accounting dot1x default start-stop group radius

6.   aaa accounting system default start-stop group radius

7.    end


DETAILED STEPS
 Command or ActionPurpose
Step 1
enable


Example:

Device> enable

 

Enables privileged EXEC mode.

  • Enter your password if prompted.
 
Step 2
configure terminal


Example:

Device# configure terminal

 

Enters global configuration mode.

 
Step 3
aaa new-model


Example:

Device(config)# aaa new-model

 

Enables AAA globally.

 
Step 4
radius-server host {hostname | ip-address} auth-port port-number acct-port port-number


Example: |

Device(config)# radius-server host 172.20.39.46 auth-port 1812 acct-port 1813 key rad123

 

Specifies a RADIUS server host.

  • The auth-port keyword and port-number argument specifies the User Datagram Protocol (UDP) destination port for authentication requests.
  • The acct-port keyword and port-number argument specifies the UDP destination port for accounting requests.
 
Step 5
aaa accounting dot1x default start-stop group radius


Example: |

Device(config)# aaa accounting dot1x default start-stop group radius

 
Provides information about all IEEE 802.1x-related user events.
  • The start-stop keyword sends a "start" accounting notice at the beginning of a process and a "stop" accounting notice at the end of a process. The "start" accounting record is sent in the background. The requested user process begins regardless of whether the "start" accounting notice was received by the accounting server.
  • The group radius is the exact name of the character string used to name the list of all RADIUS servers for authentication as defined by the aaa group server radius command.
 
Step 6
aaa accounting system default start-stop group radius


Example: |

Device(config)# aaa accounting system default start-stop group radius

 
Performs accounting for all system-level events not associated with users, such as reloads.
Note   When system accounting is used and the accounting server is unreachable at system startup time, the system will not be accessible for approximately two minutes.
  • The start-stop keyword sends a "start" accounting notice at the beginning of a process and a "stop" accounting notice at the end of a process. The "start" accounting record is sent in the background. The requested user process begins regardless of whether the "start" accounting notice was received by the accounting server.
  • The group radius is the exact name of the character string used to name the list of all RADIUS servers for authentication as defined by the aaa group server radius command.
 
Step 7
end


Example:

Device(config)# end

 

Exits global configuration mode and enters privileged EXEC mode.

 

Configuration Example for IEEE 802.1X RADIUS Accounting

Example: Enabling IEEE 802.1X RADIUS Accounting

This example shows how to specify the server with IP address 172.20.39.46 as the RADIUS server. The first command configures the RADIUS server, specifying port 1812 as the authorization port, 1813 as the UDP port for accounting, and rad123 as the encryption key:


Note
You must configure the RADIUS server to perform accounting tasks. 
Router# configure terminal
Router(config)# aaa new-model
Router(config)# radius-server host 172.20.39.46 auth-port 1812 acct-port 1813 key rad123
Router(config)# aaa accounting dot1x default start-stop group radius
Router(config)# aaa accounting system default start-stop group radius
Router(config)# end
Router#

Additional References

Related Documents

Related Topic

Document Title

Cisco IOS commands

Cisco IOS Master Commands List, All Releases

Security commands

Standards

Standard

Title

IEEE 802.1X

Port Based Network Access Control

MIBs

MIB

MIBs Link

  • IEEE8021-PAE-MIB
  • Cisco-PAE-MIB

To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://www.cisco.com/go/mibs

RFCs

RFC

Title

RFC 3580

IEEE 802.1X Remote Authentication Dial In User Service (RADIUS) Usage Guidelines

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

http://www.cisco.com/cisco/web/support/index.html

Feature Information for IEEE 802.1X RADIUS Accounting

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.

Table 3Feature Information for IEEE 802.1X RADIUS Accounting
Feature Name Releases Feature Information

IEEE 802.1X RADIUS Accounting

12.4(11)T

This feature is used to relay important events to the RADIUS server (such as the supplicant's connection session). The information in these events is used for security and billing purposes.

In Cisco IOS Release 12.4(11)T, this feature was introduced on the following Cisco ISRs equipped with cards or modules that include switch ports:

  • Cisco 800 Series ISR
  • Cisco 870 Series ISR
  • Cisco 1800 Series ISR
  • Cisco 2800 Series ISR
  • Cisco 3800 Series ISR

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

© 2012 Cisco Systems, Inc. All rights reserved.