ISE Device Administration - Command Accounting F5

[Arie --]

Hi,

Does anyone ever try configure F5 BIG-IP to send accounting and recorded the executed command in TACACS+ Accounting?

I use ISE 2.3 and enable Device Administration. The Authentication and Authorization work fine for me. But for Accounting, I can't see any TACACS+ Command Accounting record which sent from F5. Only Interim Accounting which can be viewed in TACACS+ Accounting.

Is there any missing configuration in Cisco ISE to capture of TACACS+ Command Accounting?

Thank you

Arie

[nspasov]

Hello Arie-

Do you know for sure if F5 supports command-level Accounting? I haven't worked with F5 in a while and don't have a device to test this with. However, many non-Cisco devices that support TACACS+ do not actually support command-level Accounting. Doing a quick search on F5's support documentation also confirms this:

If you use the TACACS+ Accounting feature, the accounting service sends start and stop accounting records to the remote server.

https://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-authentication-single-sign-on-11-5-0/19.html

I faced with the same issue when utilizing TACACS+ with Palo Alto and Addtran.

It is probably best to reach out to F5's support and have them confirm this but my guess is that this is not supported.

I hope this helps!

Thank you for rating helpful posts!

[Arie --]

Hi,

Thank you for your answer.

Actually I refer to another documentation also:

https://support.f5.com/csp/article/K13762

In that documentation, I found that F5 can send audit data either TACACS+ or RADIUS Accounting server.

You want to configure the BIG-IP system to send audit data to either a Terminal Access Controller Access-Control System Plus (TACACS+) or RADIUS accounting server.
Audit event messages are messages that the BIG-IP system logs as a result of changes you made to the BIG-IP system configuration using the Traffic Management Shell (tmsh), the bigpipe utility, or the Configuration utility.

I have followed the configuration steps on that link, but still no luck to find TACACS+ command accounting record in Cisco ISE.

Thank you.

[nspasov]

Oh that is good to know! Thank you for sharing the document. Unfortunately, the only thing I can suggest at this point is reaching out to TAC and/or F5 support for additional guidance.

Please update the thread if you are able to resolve the issue.

Thank you for rating helpful posts!