TACACS Accounting

[jharper2]

I have a cisco ASR9K Series running Cisco IOS XR Software, Version 5.3.3. I am using ISE version 2.2.0.470. I have aaa accounting commands configured on the router. I am having trouble accounting for commands that are not authorized. Is there another command that I need to configure the router or a setting that I need to change in ISE to ensure all commands whether they are authorized or not are logged in ISE? 

[paul]

Post your AAA accounting configuration.

[jharper2]

aaa accounting exec default start-stop group tacacs+

aaa accounting commands default stop-only group tacacs+

[ognyan.totev]

This is mine config for tacacs

aaa authentication login default group ISETEST local

aaa authentication enable default group ISETEST enable line none

aaa authorization console

aaa authorization config-commands

aaa authorization exec default group ISETEST local

aaa accounting commands 15 default start-stop group ISETEST

[kthiruve · Accepted solution]

Thank you Paul and Ognyan.

Justin,

Please look at the how to guides for TACACS for best practices.

ISE Device Administration (TACACS+)

Couple of things

Make sure you use right group for tacacs. Use named group as above.

Also call out the privilege level of commands as mentioned above.

Remember that you have to authorize the shell before accounting.

Hope it helps.

Thanks

Krishnan