User's Manual

110
Users Manual of CS-6306R
As with authentication, you configure AAA authorization by defining a named list of authorization methods,
and then applying that list to various interfaces. For information about configuring authorization using AAA,
refer to the chapter "Configuring Authorization."
• Accounting -- Provides the method for collecting and sending security server information used for billing,
auditing, and reporting, such as user identities, start and stop times, executed commands (such as PPP),
number of packets, and number of bytes.
Accounting enables you to track the services users are accessing as well as the amount of network resources
they are consuming. When AAA accounting is activated, the network access server reports user activity to the
RADIUS or TACACS+ security server (depending on which security method you have implemented) in the
form of accounting records. Each accounting record is comprised of accounting AV pairs and is stored on the
access control server. This data can then be analyzed for network management, client billing, and/or auditing.
All accounting methods must be defined through AAA. As with authentication and authorization, you configure
AAA accounting by defining a named list of accounting methods, and then applying that list to various
interfaces. For information about configuring accounting using AAA, refer to the chapter "Configuring
Accounting."
6.1.1.2 Benefits of Using AAA
AAA provides the following benefits:
 Increased flexibility and control of access configuration
 Scalability
 Standardized authentication methods, such as RADIUS, TACACS+, and Kerberos
 Multiple backup systems
6.1.1.3 AAA Principles
AAA is designed to enable you to dynamically configure the type of authentication and authorization you want
on a per-line (per-user) or per-service (for example, IP, IPX, or VPDN) basis. You define the type of
authentication and authorization you want by creating method lists, then applying those method lists to
specific services or interfaces.
6.1.1.4 Method Lists
A method list is a sequential list that defines the authentication methods used to authenticate a user. Method
lists enable you to designate one or more security protocols to be used for authentication, thus ensuring a
backup system for authentication in case the initial method fails. Cisco IOS software uses the first method
listed to authenticate users; if that method does not respond, Cisco IOS software selects the next
authentication method in the method list. This process continues until there is successful communication with
a listed authentication method or the authentication method list is exhausted, in which case authentication
fails.