Configuring Accounting - Juniper JUNOSE SOFTWARE 11.0.X - BROADBAND ACCESS CONFIGURATION GUIDE 4-1-2010 Configuration Manual

3.
4.
5.

Configuring Accounting

Once TACACS+ support is enabled on the router, you can configure TACACS+
accounting. Perform the following steps:
1.
2.
3.
4.
Note that Exec accounting and User Exec mode commands accounting for privilege
levels 14 and 15 are now enabled for all lines and consoles with the creation of their
default method list, as shown in Step 2.
aaa accounting commands
host1(config)#aaa authentication login tac tacacs+ radius enable
Specify the privilege level by defining a methods list that uses TACACS+ for
authentication.
host1(config)#aaa authentication enable default tacacs+ radius enable
Configure vty lines.
host1(config)#line vty 0 4
Apply an authentication list to the vty lines you specified on your router.
host1(config-line)#login authentication tac
Specify AAA new model as the accounting method for your router.
host1(config)#aaa new-model
Enable TACACS+ accounting on the router, and configure accounting method
lists. For example:
host1(config)#aaa accounting exec default start-stop tacacs+
host1(config)#aaa accounting commands 0 listX stop-only tacacs+
host1(config)#aaa accounting commands 1 listX stop-only tacacs+
host1(config)#aaa accounting commands 13 listY stop-only tacacs+
host1(config)#aaa accounting commands 14 default stop-only tacacs+
host1(config)#aaa accounting commands 15 default stop-only tacacs+
(Optional) Specify that accounting records are not generated for users without
explicit user names.
host1(config)#aaa accounting suppress null-username
Apply accounting method lists to a console or lines. For example:
host1(config)#line console 0
host1(config-line)#accounting commands 0 listX
host1(config-line)#accounting commands 1 listX
host1(config-line)#accounting commands 13 listY
host1(config-line)#exit
host1(config)#line vty 0 4
host1(config-line)#accounting commands 13 listY
Chapter 9: Configuring TACACS+
Configuring TACACS+ Support
317