Cisco ASA Authentication, Authorization, and Accounting Network Security Services

Configuring Accounting

To configure accounting on the Cisco ASA via ASDM, complete the following steps. The goal in the following example is to enable accounting for all IP traffic sourced from the 10.10.1.0/24 network and destined to the 10.10.2.0/24 network.

• step 1. Log in to ASDM and navigate to Configuration > Firewall > AAA Rules.
• step 2. Click on Add and select Add Accounting Rule.
• step 3. Select the interface where the accounting rule is to be applied. In this example, the inside interface is used.
• step 4. Under Action, select Account to enable accounting.
• step 5. Select the AAA server group from the AAA Server Group pull-down menu. In this example, the previously configured AAA server group called my-radius-group is used.
• step 6. You can configure the source and destination to define specific traffic traversing the Cisco ASA that is to be used for accounting. Configure the specific source IP address or network under the Source field. By default the any keyword is displayed to enable accounting for all sources. In this example, the source network 10.10.1.0/24 is used.
• step 7. Configure the specific destination IP address or network under the Destination field. By default, the any keyword is displayed to enable accounting for all sources. In this example, the destination network 10.10.2.0/24 is used.
• step 8. Select the specific service or protocol in the Service field. In this example, the ip keyword is used to enable accounting for all IP traffic sourced from the 10.10.1.0/24 network and destined to the 10.10.2.0/24 network.
• step 9. Optionally, you can enter a description for this accounting rule in the Description field.
• step 10. Click Apply to apply the configuration changes.
• step 11. Click Save to save the configuration in the Cisco ASA.

To enable accounting via the CLI use the aaa accounting command:

   aaa accounting match access_list_name if_name server_tag
   

Example 6-13 demonstrates how to configure accounting on the Cisco ASA via the CLI.

Example 6-13. Enabling Accounting by Using an ACL to Define Interesting Traffic

New York(config)# access-list 100 permit ip 10.10.1.0 255.255.255.0 10.10.2.0
255.255.255.0
New York(config)# aaa accounting match 100 inside my-radius-group

In Example 6-13, an ACL is configured to enable accounting for all connections initiated from 10.10.1.0/24 to 10.10.2.0/24. The ACL is then applied to the aaa accounting match command. A previously defined AAA server group named my-radius-group is used with this command.

You can also use the aaa accounting include | exclude command options, as demonstrated for the aaa authentication command. The aaa accounting match command makes the include and exclude options obsolete.

RADIUS Accounting

Table 6-6 lists all the RADIUS accounting messages supported by Cisco ASA.

Table 6-6. RADIUS Accounting Messages Supported in the Cisco ASA

The accounting-on message marks the start of accounting services. Subsequently, to mark the end of accounting services, use the accounting-off message. The start and stop accounting records messages are used to label when a user started a connection to a specific service. These sessions are labeled with their own accounting session IDs.

TACACS+ Accounting

Table 6-7 lists all the TACACS+ accounting messages that Cisco ASA supports.

Table 6-7. TACACS+ Accounting Messages Supported by Cisco ASA

Cisco ASA also enables you to configure command accounting, depending on the user's privilege level. Use the following command to enable this feature:

aaa accounting command {privilege level} tacacs_server_tag

Example 6-14 demonstrates how to configure command accounting on the Cisco ASA, depending on the user's privilege level.

Example 6-14. Enabling Command Accounting

New York(config)# aaa accounting command privilege 15 my-tacacs-group

In Example 6-14, the accounting command is enabled for users that execute a privilege level 15 command.

Alternatively, you can configure command accounting via ASDM by navigating to Configuration > Device Management > Users/AAA > AAA Access > Accounting and selecting Enable under the Require Command Accounting for ASA section.

Troubleshooting Administrative Connections to Cisco ASA

You can authenticate administrative connections by using RADIUS, TACACS+, or the Cisco ASA local user database. The following debug commands are available to troubleshoot AAA problems when you are trying to connect to the Cisco ASA for administration:

• debug aaa—Provides information about the authentication, authorization, or accounting messages generated and received by the Cisco ASA.
• debug radius—To troubleshoot RADIUS transactions, use this command, which has several options:
  • all—Enables all debug options
  • decode—Shows decoded RADIUS transaction messages
  • session—Provides information about all RADIUS sessions
  • user—Enables you to capture RADIUS transaction information for a specific user connection
• debug tacacs—To troubleshoot TACACS+ transactions, use this command with either of the following options:
  • session—Provides detailed information about all TACACS+ transactions
  • user—Allows you to capture TACACS+ transaction information for a specific user connection

If you enter debug tacacs without any options, the debug command is enabled with the session option by default. Example 6-15 includes the output of debug tacacs during a successful Telnet authentication.

Example 6-15. Output of debug tacacs During a Successful Telnet Authentication

New York# debug tacacs
 mk_pkt - type: 0x1, session_id: 4
user: user1
 Tacacs packet sent
Sending TACACS Start message. Session id: 4, seq no:1
Received TACACS packet. Session id:4  seq no:2
tacp_procpkt_authen: GETPASS
Authen Message: Password:
mk_pkt - type: 0x1, session_id: 4
mkpkt_continue - response: ***
 Tacacs packet sent
Sending TACACS Continue message. Session id: 4, seq no:3
Received TACACS packet. Session id:4  seq no:4
tacp_procpkt_authen: PASS
TACACS Session finished. Session id: 4, seq no: 3

In Example 6-15, User1 connected to the Cisco ASA via Telnet. The Cisco ASA was configured to perform authentication via an external TACACS+ server. The first highlighted line shows that User1 attempted a connection to the Cisco ASA. The second highlighted line shows the ASA requesting the user's password. The user information is sent to the TACACS+ server and is finally authenticated. The third highlighted line shows that the authentication was successful. Example 6-16 includes the output of debug tacacs during an authentication failure. In this example, the incorrect password was entered by the user and the TACACS+ server failed its authentication.

Example 6-16. Output of debug tacacs During a Failed Authentication Because of Wrong Password

New York# debug tacacs
 mk_pkt - type: 0x1, session_id: 5
 user: user1
 Tacacs packet sent
Sending TACACS Start message. Session id: 5, seq no:1
Received TACACS packet. Session id:5  seq no:2
tacp_procpkt_authen: GETPASS
Authen Message: Password:
mk_pkt - type: 0x1, session_id: 5
mkpkt_continue - response: ***
 Tacacs packet sent
Sending TACACS Continue message. Session id: 5, seq no:3
Received TACACS packet. Session id:5  seq no:4
tacp_procpkt_authen: FAIL
TACACS Session finished. Session id: 5, seq no: 3
The highlighted line in Example 6-22 shows the authentication FAIL message.

In Example 6-17, the TACACS+ server was offline or unreachable.

Example 6-17. Output of debug tacacs While TACACS+ Server Is Unreachable

New York# debug tacacs
mk_pkt - type: 0x1, session_id: 6
 user: user1
Tacacs packet sent                                   
Sending TACACS Start message. Session id: 6, seq no:1
Received TACACS packet. Session id:6  seq no:2
TACACS Request Timed out. Session id: 6, seq no:1
TACACS Session finished. Session id: 6, seq no: 1
mk_pkt - type: 0x1, session_id: 6
user: user1
Tacacs packet sent                                  
Sending TACACS Start message. Session id: 6, seq no:1
Received TACACS packet. Session id:6  seq no:2
TACACS Request Timed out. Session id: 6, seq no:1
TACACS Session finished. Session id: 6, seq no: 1
mk_pkt - type: 0x1, session_id: 6
 user: user1
Tacacs packet sent                                  
Sending TACACS Start message. Session id: 6, seq no:1
Received TACACS packet. Session id:6  seq no:2
TACACS Request Timed out. Session id: 6, seq no:1
TACACS Session finished. Session id: 6, seq no: 1
aaa server host machine not responding

The highlighted lines show how the Cisco ASA attempts to communicate with the TACACS+ server three times and finally finishes all authentication transactions. The show aaa-server command is useful while troubleshooting and monitoring authentication transactions. Example 6-18 includes the output of the show aaa-server command for all TACACS+ transactions.

Example 6-18. Monitoring and Troubleshooting TACACS+ Transactions with the show aaa-server Command

New York# show aaa-server protocol tacacs+
Server Group:    mygroup
Server Protocol: tacacs+
Server Address:  172.18.124.145
Server port:     49
Server status:   ACTIVE, Last transaction at 21:05:43 UTC Fri March 20 2009
Number of pending requests               0
Average round trip time                  43ms
Number of authentication requests       4
Number of authorization requests        0
Number of accounting requests           0
Number of retransmissions               0
Number of accepts                        3
Number of rejects                        1
Number of challenges                     4
Number of malformed responses           0
Number of bad authenticators            0
Number of timeouts                       0
Number of unrecognized responses        0

In Example 6-18, the Cisco ASA processed a total of four authentication requests. Three of those requests were successfully authenticated and one was rejected by the TACACS+ server.

Troubleshooting Firewall Sessions (Cut-Through Proxy)

The techniques to troubleshoot cut-through proxy sessions on Cisco ASA are similar to those mentioned in the previous section. Additionally, the show uauth command can be used to display information about authenticated users and current transactions. Example 6-19 shows the output of this command.

Example 6-19. Output of the show uauth Command

New York# show uauth
                          Current    Most Seen
Authenticated Users       0          0
Authen In Progress        1          3

In Example 6-19, a total of three concurrent authentication requests were processed by the Cisco ASA. One is currently being processed.