Mds and tacacs accounting

Hi, i'm trying to get a mds 9509 to work with cisco ACS. I've got it okay for login authentication, however I can't seem to get it the report accounting info i.e. any changes. I came across a document that stated that the mds uses interim-update Radius accounting request packets to communicate log info to the radius server.
I'm using TACACS+ for authentication, but created a radius server and group on the mds pointing towards radius on the ACS for accounting by no joy.
Has anyone been successful in getting this to owrk, and if so could you tell me how.
thanks in advance
Grant

Try this URL:
http://www.cisco.com/en/US/products/ps5989/products_configuration_example_chapter09186a0080530cd1.html

Similar Messages

WAAS and TACACS

We are trying to get our WAAS environment to authenticate against TACACS and then fall over to local if TACACS is unavailable. For engineer logins everything is working as expected. However we are seeing several thousand failures against the TACACS server from a username of "CMS". This user is not configured in the CM or in TACACS. So we log the failed login and CMS logs into the WAE due to the failover to local mechanism. Looking at packet captures, and debugging aaa on the WAE's it is definitely a CMS user that logs in but shows 127.0.0.1 as its "from" host. I am fairly confident this is automation within the WAE syncing with the CM or vice versa. Does anyone know how to get WAAS and TACACS to work together without a mass amount of login failures? Is there a way this CMS user can be cloned/duplicated on the tacacs server? What is the password for this automation user?
Thanks in advance.

Hi Stan,
WAE can authenticate against TACACS, RADIUS and Central Manager (Local) at any time depending on your configuration.
There are couple of things to keep in mind while configuring TACACS on WAE, on both sides - TACACS adn WAE CM.
On TACACS side:
1. Please make sure to create right username.
2. Please make sure to verify if you are using ASCII password authentication.
3. Try to use less than 15 letters - Alphanumeric TACACS password.
4. Please provide right user level / group level persmissions. This is somewhere under user account properties. Please also make sure to select right user password under user properties.
5. Verify if this user needs level 15 (admin equivalent account).
On WAE CM side:
1. Please make sure to select right authentication method as primary and secondary.
2. Please make sure to enable the check box for authentication methods.
You can verify the failure / successful log events on TACACS server in order to find out if the user is atleast trying to authenticate against TACACS.
I am sure you have looked at this link to find out all the required steps: Configuring TACACS+ Server Settings
Hope this helps.
Regards.
PS: Please mark this as Answered, if this resolves your issue.

NCS TACACS accounting via ACS

If I choose to authenticate NCS users through Cisco ACS (5.4 in this instance) via TACACS, do I still have the ability to do accounting to track what changes they have made? I'm not getting anything in the TACACS accounting reports and I don't see anywhere to configure TACACS for accounting within NCS gui like I can on a WLC. I know that NCS has an internal audit trail but if a users account is both a local account on NCS as well as an account being authenticated through ACS does the Audit trail on NCS for that local user still contain the information about changes the user made? I ask because it looks like it does but I want to make sure I'm not going mad. Here is my example:
Local account username: NCS_Admin2
AD account via TACACS username: NCS_Admin2
Audit trail for the NCS_Admin2 account on NCS looks like changes are being logged to NCS even though the user is logging in with their AD credentials via TACACS.
I know that is probably as clear as mud.
Thanks.
Todd

User is authenticated with TACACS
NCS_Admin2
NCS.customerdomain.local
2013-Mar-05, 10:18:30 EST
2013-Mar-05, 11:22:36 EST
TACACS+
Admin

Regarding Tacacs+ Accounting

Dear All,
This is regarding Tacacs+ accounting. We have Cisco ACS server 4.2 for AAA. I want to configure accounting in such a way that I should get the reports containing what are the commands used by user after successfully logged in into the route. Currently I am getting reports containing IN and OUT time , who was the user etc. So what to change if I want all the commands used by user on the router after logged in?
Thanks,
Abhisar.

hi,
You will have to configure command authorization for that and then the command accounting.
following link throws some light on it.
http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/mgaccess.html#wp1059882
Hope this helps.
Regards,
Anisha
P.S.: please mark this post as answered if you feel your query is answered. Do rate helpful posts.

Tacacs+ accounting log question

I have a tacacs server running for accounting purpose only (so I use local authentiation). So I can collect all accounting logs only.
This is a snapshot for accounting part.
Tacacs accounting logs
<102> 2014-02-23 10:20:22 [10.254.1.2:22823] 02/23/2014 10:20:22 NAS_IP=10.254.1.x Port=443 rem_addr=10.254.50.129 User= brian Flags=Stop task_id=57 cmd=perfmon interval 10 service=shell elapsed_time=0
<102> 2014-02-23 10:23:51 [10.254.1.2:58167] 02/23/2014 10:23:51 NAS_IP=10.254.1.x Port=0 rem_addr=10.254.50.129 User=brian Flags=Stop task_id=58 cmd=configure term service=shell elapsed_time=0
<102> 2014-02-24 07:06:31 [10.254.1.2:19784] 02/24/2014 07:06:31 NAS_IP=10.254.1.x Port=443 rem_addr=10.254.51.166 User=mike Flags=Stop task_id=59 cmd=perfmon interval 10 service=shell elapsed_time=0
<102> 2014-02-24 07:07:53 [10.254.1.2:19254] 02/24/2014 07:07:53 NAS_IP=10.254.1.x Port=0 rem_addr=10.254.51.166 User=mike Flags=Stop task_id=5a cmd=configure term service=shell elapsed_time=0
As you can see, I can't see any command lines, such as show int ip b. I can see all routers and switches logs, but ASA logs shows only like above. No mather what commands I used, it only shows above logs. Do i miss something? I like to capture all commands lines when users use ASDM because we use always ASDM.
I used Free tacacs+ server, not ACS.
Thanks for your time.

Hi Patrick,
In the ACS View Reports (Monitoring & Reports > Reports > Catalog > AAA Protocol) you can select the
radio button and by selecting 'Run' on the bottom run a specific query. Without that by default you will see only a report from one day.
For the 2nd question, yes the ACS View is designed to store that information, however if needed you can send the logs to an external syslog server or perfrom regular backups of the ACS View database.
Kind regards,
Pawel

Config the TACACS+ Accounting attributes

hi,
the ACS4.1 as AAA server using TACACS+ ,the customer wants to record the command they used when they loggined the AAA client ,how to config the TACACS+ Accounting attributes ?

These commands will perform accounting records whenever a level 0,1,15 command is used
This is logged to the
"Reports and Activities" -> "TACACS+ Administration"
aaa accounting commands 0 default start-stop group tacacs+
aaa accounting commands 1 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+

TACACS+ Accounting Question

Dear all,
I would like to know TACACS+ accounting option in cisco.
We deployed AAA machine which is Avenda in our operation network and able to capture accounting commands ONLY for valid commands. Does the TACACS+ also can capture invalid commands and send to Avenda (Our AAA machine) ?
Please help to clarify.

Hi,
This is something device specific. In case of IOS it forwards only valid commands to tacacs server. Example- If we issue command "show user" it will log it and if we issue command "show dog" it will not be logged.
Hope that helps!
Regards,
~JG
Do rate helpful posts

I have gmail and hotmail account on my macbook. In gmail I can visualize all the mailboxes but in hotmail i only can see the inbox ¿how can I visualize the rest of the mailboxes? thanks

I have gmail and hotmail account on my macbook.
In gmail I can visualize all the mailboxes but in hotmail i only can see the inbox ¿how can I visualize the rest of the mailboxes?
I have the same problem with my ipad; the solution would be the same?
thanks

Hello Sophie59
You should be able to see two different tabs when setting up the email if you go to Other > Add Mail Account. Once you enter in the email address and password, you should be at the next screen to provide more details about the email as far as incoming and outgoing servers and at the top there will be a blue section to add it in as a POP or IMAP email account. Check out the article below for further troubleshooting and emails setup options.
iOS: Troubleshooting Mail
http://support.apple.com/kb/ts3899
iOS: Adding an email account
http://support.apple.com/kb/ht4810
Regards,
-Norm G.

My iCloud account name was inputted incorrectly when my iPhone was set up. I made a new iCloud account but my phone still automatically loads the old and unusable iCloud account. How can I update my phone to load the new and correct account?

My iCloud account name was inputted incorrectly during initial phone set up. I created another iCloud account name but it is still the old and wrong iCloud account that automatically loads whenever I access the iCloud tab on my phone. How do I replace it my new and correct account name?

She won't after the change.
Note you can use the same Apple ID in
Settings > iTunes & App Store > Apple ID: > here to share purchased music, apps and books.
Other than that each of you should use your own Apple ID for iMessage, FaceTime, iCloud, Game Center, etc.

What is difference between Reconciliation Account and Revenue account.?`

What is difference between Reconciliation Account and Revenue account.?
Where does it effects after a sales order , delivery doc. or billing doc.?

Hello Mukesh the comments givan by Amol and Siva kumar are correct.
Here I am telling you how these accouts arer wrking in sales order and at billing and delivery.
Our reconsilation account is reconsile with customer that why when you create the sales order you are mentioning the customer at this time reconsiation account works.
Whenever you doing any posting there is an accounting entry is mae in accounts book right .
At the time of Delivery and billing both the accounts are affected as per the accounting rule .
I hpoe this will you help you
Regards
ravi

MB5L Report Discrepacy for Material and Stock Account Currency

I have found in the MB Report Discrepancy for Material and Stock Account Currency. Why is this happening? Why is there a variance between total price in materials and stock account? Anyone please help me. I'm abaper but now been pushed to do logistic. I need help for this issue.

Hi,
Here's some information from help. Variances can occur for the following reasons:
You have entered postings to the stock account manually.
The stock account includes not only stock postings, but also other postings. In this case, you should check the account determination in the Customizing for Valuation and Account Assignment. Make sure that the stock accounts are used solely for the transaction key BSX (stock postings).
Check Account Determination - OMWB
The account assignment for the stock accounts (transaction key BSX) was changed during productive operation; the respective stocks, however, were not deducted from the old account (movement type 562) and posted to the new one (movement type 561).
Cheers !

Aging report and Control account value not matching

Hi All
The value what i am getting from Vendor liabilities aging and Control account is not matching for the same dates, all my parameters or selection criteria are same
Same report if i am taking for the current date it giving correctly,
If i am trying for a previous day the problem is happening
How can i solve this issue

Hi,
Please check if the transactions are done for different Control Accounts and both the account balances are included in the Aging Report.
Also, check that ALL the customers/vendor groups are taken.
Make sure that you are running the backdated aging with the checkbox as mentioned in the Note 800294.
If still facing problems may be you can provide with more details as to what the control account balances and what is the Aging, difference.
PS: Check if there is any manual journal entry is created in the control account?
Kind Regards,
Jitin
SAP Business One Forum Team

How to get all open sales orders of a customer and also account group

I want to know the logic to find all open sales orders of a customer and also account group

Hi,
You can check the status weather a Sales order is Open or not by checking its billing status form the following:
Check table VBUK and VBUP for delivery status "LFSTK" and billing status "FKSTK".
Rward points if helpful answer.
Ashven

If i have a work ipad with a work email and a shared icloud for all employees, can i set up a second itunes and icloud account with a separate email address on the same ipad for my personal stuff?

i am a teacher and my school has given all of us a ipad to use. it is set up with my school email and a shared itunues and icloud account. they have told us we can use it for anything that can be used for education purposes. i have downloaded books and other items that i have marked up for my use. however if there is ever a problem i cant identify my applications or books if other teachers have downloaded the same apps or books as well as my documents. is there a way to set up a 2nd itunes account and icloud account so that i may use that when backing up anything that would be personalized by me so that i can find what is rightfully mine. they are ok with it but were unsure how to do this, so can anyone help me? thanks

Sorry, you cannot use more than one iTunes account at a time.

Issues with Mail and SMTP and Gmail Accounts

So this isn't a question....more like a solution that I had to figure out.
We have multiple gmail accounts in our family and after upgrading to OSC Yosemite our gmail accounts wen't haywire. My wife was sending emails that eventually were sent from my gmail account (mass neighborhood emails at that.....and all replies came to me instead of her). I spent about 2 hours investigating and put together several different threads that finally fixed out problem. The root of the issue is that you can share the same Incoming Mail Server for all of your gmail accounts and your mail will go to the accounts that it is supposed to go to, but you have to have individual Outgoing Mail Servers for each of your accounts otherwise all outgoing mail will come from one account only. I don't know why this happened, it is a pain in the butt, but here's how I fixed it with 3 gmail accounts running through 1 mac.
1st - you need to remove all of your gmail accounts from mail via Internet Accounts in Settings. Just highlight the account and hit the minus sign at the bottom. You won't lose anything if you have your gmail settings set to default which backs everything up to Google's servers....it will all load back to you mac and it will all be available online at gmail.com
2nd - you need to add back all of your accounts one at a time (and follow all of the following steps for each account before adding another). Select the plus sign and choose Google (for gmail accounts only).
3rd - Give your gmail account a recognizable name in the "Name" field (if you have multiple Gmail accounts to add, you will want to distinguish between them).
4th - type in your username ([email protected]) and password. Make sure to add the suffix @gmail.com.
5th - Check the boxes that you want to add to your mac (mail, contacts, calendars, messages, notes).
6th - Click the "Details" button to ensure that you have an adequate description (see # 3 above) if you are going to have multiple gmail accounts to add.
7th - Open the Mail app.
8th - From Mail Preferences/Account Information Tab - make sure that you account is Enabled (check box next to "Enable Account", make sure that you have an adequate description name, email address is correct, Incoming mail server is imap.gmail.com, Username is your normal gmail login username (absent any suffix like .gmail.com), password is your gmail password.
9th - Then, from Preferences click on the Advanced tab and....Uncheck "Automatically detect and maintain account settings".
10th - Then, go back to Account Information Tab and.....from the Outgoing Mail Server (SMTP) dropdown box, select Edit SMTP List....
11th - You need to create an individual SMTP Server Account for each gmail account that you plan to add.
12th - To do this click the plus button. Server Name should always be smtp.gmail.com. Type in your own Description (I recommend naming it after the gmail account that you plan to attach it to).
13th - TLS Certificate should be "None"
14th - Click the Advanced Tab - From here, uncheck the box for "Automatically detect and maintain account settings". Then make sure Port is 587 (default is 25 for some ungodly reason). Check the box for "Use SSL".
15th - Set authentication to "Password". User name MUST contain a suffice (i.e [email protected]). Password is your normal gmail password.
16th - Click OK.
17th - Now your back at Preferences/Account Information - Link your account to the SMTP server that you just created by using the dropdown box next to Outgoing Mail Server (SMTP).
18th - Save all changes and close out of Mail App.
19th - Restart Mail and recheck steps 8-15....for some reason my passwords kept getting erased, but they eventually saved and took.
20th - Add another gmail account by following these steps and then recheck all along the way for passwords, suffixes, everything. You will want to make sure that your accounts are all properly linked to their respective Outgoing Mail Servers (hence the distinct naming descriptions).
21st - Once you have added multiple accounts send email between them to make sure that they are being sent from and received to the correct accounts.

Wow! Oh my goodness Patrick, thank you so much man. That's a ton of informatiion to take the time to write out step by step and share with strangers. I really, really am grateful to you. I've been dealing with this for a month, half the month I kept changing my passwords and kept assuming I was making some mistake. It used to work fine. About a week ago I started looking for a solution and couldn't find one that worked.
You have changed that sir! I'm good to go, stress level will lower when I am on my Mac, and I'm so glad to not have all these messages popping back up that I was done with!
Muchos Gracias Amigo! Owe you one...

Mds and tacacs accounting

Similar Messages

Maybe you are looking for