WLC8510 AAA Accounting Record

Dear All,
I listed an AAA accounting record from my radius server with WLC8510 after I finished a session with downloaded a 100MB file.
1.) The Acct-Output-Octets > Input-Octets mean the Octets direction is from Controller to Client because I download a 100mb file, in general should be input > outpu, but in cisco WLC, it is inverted, is it correct?
2) The packet number of input and output is similar, that is different with other brands when I perform the same testing.
NAS-Identifier = "WLC8510"
        Airespace-WLAN-Id = 124
        Acct-Session-Id = "52a91c23/00:1c:bf:78:2b:21/1575117"
        NAS-Port-Type = Wireless-IEEE-802-11
        Acct-Authentic = Remote
        Tunnel-Type = 0:VLAN
        Tunnel-Medium-Type = 0:802
        Tunnel-Private-Group-ID = 30
        Event-Timestamp = 1386814675
        Acct-Status-Type = Stop
        Acct-Input-Octets = 3773718
        Acct-Input-Gigawords = 0
        Acct-Output-Octets = 98257335
        Acct-Output-Gigawords = 0
        Acct-Input-Packets = 64838
        Acct-Output-Packets = 64886
<omitted>
Thanks.
Mic

Check the following services are working:
CSAdmin
CSauth
CSDBsync
CSlog
CSmon
cSradius
CSTacacs

Similar Messages

Aaa accounting records

I have asa5510 with aaa accounting configured to microsoft IAS radius without authentication, the output is so confusing more that 40 columns
is there a way to know the records, at least the essential ones; session-time, bytes-in, bytes-out
thanks
Elie

thanks JG
there are 2 output options in IAS, DB format and IAS; the DB format does not show the IP addresses.
the IAS is like below
192.168.200.1,unknown,01/13/2008,00:00:06,IAS,ISA,5,0,14,193.227.177.130,16,53,40,1,44,10337B5E,4,192.168.200.1,4108,192.168.200.1,4116,9,4128,ASA5510,4154,ASA,5000,ip:source-port=1034,5000,ip:destination-port=53,5000,ip:source-ip=192.168.200.254,5000,ip:destination-ip=193.227.177.130,4136,4,4142,0
192.168.200.1,unknown,01/13/2008,00:00:06,IAS,ISA,5,0,14,193.227.177.130,16,53,40,2,42,270,43,35,44,10337B5E,46,0,49,0,4,192.168.200.1,4108,192.168.200.1,4116,9,4128,ASA5510,4154,ASA,5000,ip:source-port=1034,5000,ip:destination-port=53,5000,ip:source-ip=192.168.200.254,5000,ip:destination-ip=193.227.177.130,4136,4,4142,0
192.168.200.1,unknown,01/13/2008,00:00:26,IAS,ISA,5,0,14,192.168.1.252,16,1745,40,1,44,1A38FC26,4,192.168.200.1,4108,192.168.200.1,4116,9,4128,ASA5510,4154,ASA,5000,ip:source-port=4880,5000,ip:destination-port=1745,5000,ip:source-ip=192.168.200.53,5000,ip:destination-ip=192.168.1.252,4136,4,4142,0
192.168.200.1,unknown,01/13/2008,00:00:56,IAS,ISA,5,0,14,192.168.1.252,16,1745,40,2,42,0,43,0,44,1A38FC26,46,31,49,0,4,192.168.200.1,4108,192.168.200.1,4116,9,4128,ASA5510,4154,ASA,5000,ip:source-port=4880,5000,ip:destination-port=1745,5000,ip:source-ip=192.168.200.53,5000,ip:destination-ip=192.168.1.252,4136,4,4142,0

Accounting record not sent (Aironet 1131AG)

I have problem with accounting on my Cisco Aironets 1131AG configured into WDS domain. There arent sent any START-STOP radius records. Why???
Cisco Aironet, Software Version 12.4(10b)JA3
---------------- debug msg -------------------
May 7 18:58:34: %DOT11-6-ASSOC: Interface Dot11Radio0, Station 0012.f004.1d4e Associated KEY_MGMT[WPAv2]
May 7 16:58:34.111: AAA/ACCT/NET(00000014): Pick method list 'acct_methods'
May 7 16:58:34.112: AAA/ACCT/SETMLIST(00000014): Handle B6000004, mlist 010F5EE8, Name acct_methods
May 7 16:58:34.112: AAA/MLIST Ref count of of mlist 0x10F5EE8 raised to 2
May 7 16:58:34.112: AAA/ACCT(00000014): Type NET: Periodic timer initialized
May 7 16:58:34.112: dot11_aaa_start_accounting: Starting accounting for user: mbe
May 7 16:58:34.112: AAA/ACCT/EVENT/(00000014): NET UP
May 7 16:59:08.995: dot11_aaa_stop_accounting: Stopping accounting for user: 0012.f004.1d4e
May 7 16:59:08.996: AAA/ACCT/EVENT/(00000014): NET DOWN
May 7 16:59:08.996: dot11_aaa_upd_accounting: Updating attributes for user: 0012.f004.1d4e
May 7 16:59:08.997: AAA/ACCT/HC(00000014): DOT11/00C07260 [sess] (rx/tx) base 0/0 pre 496/858 call 1593/1956
May 7 16:59:08.997: AAA/ACCT/HC(00000014): DOT11/00C07260 [sess] (rx/tx) adjusted, pre 496/858 call 1097/1098
May 7 16:59:08.997: AAA/ACCT/NET(00000014): Accounting record not sent
---------------- config snip -------------------
aaa group server radius t-radius
server 172.16.1.5 auth-port 2812 acct-port 2813
aaa group server radius t-radius-acc
server 172.16.1.5 auth-port 2812 acct-port 2813
aaa authentication login default local
aaa authentication login eap_methods group t-radius
aaa authentication login WLCCP group t-radius
aaa authorization network WLCCP group t-radius
aaa accounting delay-start
aaa accounting update periodic 5
aaa accounting network acct_methods start-stop group t-radius-acc
aaa accounting connection acct_methods start-stop group t-radius-acc
dot11 ssid bigspace
vlan 67
authentication open eap eap_methods
authentication network-eap eap_methods
authentication key-management wpa
accounting acct_methods
mbssid guest-mode
wlccp ap username AP1 password XXXXXXXXXXXXXXXXX
wlccp authentication-server infrastructure WLCCP
wlccp authentication-server client any WLCCP
ssid bigspace
wlccp wds priority 200 interface BVI1
radius-server attribute 32 include-in-access-req format %h
radius-server attribute 32 include-in-accounting-req format %h
no radius-server attribute nas-port
radius-server host 172.16.1.5 auth-port 2812 acct-port 2813 key XXXXXXXXXXXXX
radius-server retransmit 2
radius-server timeout 10
radius-server deadtime 3
radius-server vsa disallow unknown
radius-server vsa send accounting
radius-server vsa send authentication

I know this is late, but I think it can be helpful to those trying to send RADIUS accounting information.
I tried this out, and the reason this seems not to be sending the accounting information is because of the delay-start.
The delay-start does not seem to work with 802.11 connection accounting.

Missing Tunnel-Client-Endpoint attribute in AAA accounting from 2821

I am trying to optimise the detailed accounting records for VPN client connections on our system
but have noticed I am not receiving Tunnel-Client-Endpoint (attribute 66) in tunnel start accounting records from the router.
The VPN functionality works fine, this is just an accounting issue.
All other accouting attributes I need are received fine (times, username, VPN Framed IP, NAS identifier).
The system details are:
VPN server : Cisco 2821 with IOS 12.4(11)XW3
Tunnel type: VPDN, PPTP, MPPE 128bit, MS-CHAPv2
Accouting RADIUS: Microsoft Windows Server 2008 R2 NPS
I have used the same setup many times previously on various 2801, 2811, and 2911 platfroms with no issue (across v12 and v15 IOS).
Sending attribute 66 "Tunnel-Client-Endpoint" appeared to be standard for any tunnel setup, no config was require to send it.
Does anyone know a reason why this fairly standard tunnel RADIUS attribute is not being sent to us from the router in this case?
Example debug of tunnel start accounting message, showing that attribute 66 is not included in info sent to accouting server:
Jun 25 2013 14:55:13.591 AEST: RADIUS/ENCODE(0000061A):Orig. component type = VPDN
Jun 25 2013 14:55:13.595 AEST: RADIUS(0000061A): Config NAS IP: 0.0.0.0
Jun 25 2013 14:55:13.595 AEST: RADIUS(0000061A): sending
Jun 25 2013 14:55:13.595 AEST: RADIUS/ENCODE: Best Local IP-Address 192.168.xxx.xxx for Radius-Server 192.168.xxx.xxx
Jun 25 2013 14:55:13.595 AEST: RADIUS(0000061A): Send Accounting-Request to 192.168.xxx.xxx:1646 id 1646/220, len 184
Jun 25 2013 14:55:13.595 AEST: RADIUS: authenticator D7 DD 05 D9 72 FC 72 9C - 02 E0 6A FD D1 AC DB 06
Jun 25 2013 14:55:13.595 AEST: RADIUS: Acct-Session-Id     [44] 10 "00000642"
Jun 25 2013 14:55:13.595 AEST: RADIUS: Tunnel-Medium-Type [65] 6   00:IPv4                   [1]
Jun 25 2013 14:55:13.595 AEST: RADIUS: Tunnel-Assignment-Id[82] 3   "1"
Jun 25 2013 14:55:13.595 AEST: RADIUS: Tunnel-Server-Auth-I[91] 14 "********"
Jun 25 2013 14:55:13.595 AEST: RADIUS: Acct-Tunnel-Connecti[68] 4   "44"
Jun 25 2013 14:55:13.595 AEST: RADIUS: Framed-Protocol     [7]   6   PPP                       [1]
Jun 25 2013 14:55:13.595 AEST: RADIUS: Framed-IP-Address   [8]   6   192.168.xxx.xxx
Jun 25 2013 14:55:13.595 AEST: RADIUS: User-Name           [1]   10 "*********"
Jun 25 2013 14:55:13.595 AEST: RADIUS: Acct-Authentic      [45] 6
Jun 25 2013 14:55:13.595 AEST: RADIUS: Acct-Status-Type    [40] 6   Start                     [1]
Jun 25 2013 14:55:13.595 AEST: RADIUS: NAS-Port-Type       [61] 6   Virtual                   [5]
Jun 25 2013 14:55:13.595 AEST: RADIUS: NAS-Port            [5]   6   426
Jun 25 2013 14:55:13.595 AEST: RADIUS: NAS-Port-Id         [87] 17 "Uniq-Sess-ID426"
Jun 25 2013 14:55:13.595 AEST: RADIUS: Class               [25] 46
Jun 25 2013 14:55:13.595 AEST: RADIUS:   69 89 04 FA 00 00 01 37 00 01 02 00 C0 A8 AC 01 [i??????7????????]
Jun 25 2013 14:55:13.595 AEST: RADIUS:   00 00 00 00 00 00 00 00 00 00 00 00 01 CE 6E 22 [??????????????n"]
Jun 25 2013 14:55:13.595 AEST: RADIUS:   2F A7 37 14 00 00 00 00 00 00 00 29              [/?7????????)]
Jun 25 2013 14:55:13.595 AEST: RADIUS: Service-Type        [6]   6   Framed                    [2]
Jun 25 2013 14:55:13.595 AEST: RADIUS: NAS-IP-Address      [4]   6   192.168.xxx.xxx
Jun 25 2013 14:55:13.595 AEST: RADIUS: Acct-Delay-Time     [41] 6   0
Jun 25 2013 14:55:13.691 AEST: RADIUS: Received from id 1646/220 192.168.xxx.xxx:1646, Accounting-response, len 20
Jun 25 2013 14:55:13.691 AEST: RADIUS: authenticator E8 EC 1C 30 D2 01 8E D8 - 15 10 09 5F 37 95 D4 25
Important config
aaa new-model
aaa authentication login default local group radius
aaa authentication ppp default local group radius
aaa authorization exec default local group radius
aaa authorization network default local group radius
aaa accounting delay-start
aaa accounting session-duration ntp-adjusted
aaa accounting exec default start-stop group radius
aaa accounting network default start-stop group radius
aaa session-id common
vpdn enable
vpdn-group 1
! Default PPTP VPDN group
accept-dialin
protocol pptp
virtual-template 1
interface Virtual-Template1
ip unnumbered Dialer1
ip nat inside
ip virtual-reassembly
peer default ip address pool VPN
no keepalive
ppp encrypt mppe 128
ppp authentication ms-chap-v2
ip local pool VPN 192.168.xxx.xxx 192.168.xxx.xxx
radius-server host 192.168.xxx.xxx auth-port 1645 acct-port 1646 key 7 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Larry,
1) Please set up enable authentication to get the actual user name,
aaa authentication enable console tacacs-auth LOCAL
On ACS user setup you need to set up tacacs+ enable password.
3) Since you have defined both server for authentication and accounting ie 219 and 218 it is sending accounting to 218, as it is also defined as accounting server and firewall it active.
Use only
aaa-server tacacs-auth (dept-outside) host 10.1.26.218 key tacacs-secret
aaa-server tacacs-acct (dept-outside) host 10.1.26.219 key tacacs-secret
Now auth should go to 218 and acc to 219.
Regards,
~JG
Do rate helpful posts

Missing aaa accounting commands

Hi,
I might be being REALLY STUPID, but I am trying to config a 12.3 IOS router to send command accounting records to an ACS 3.3 server via RADIUS.
When a input the 'aaa accounting commands 15 default group radius' command, it is accepted by the router, but show the config, and its not there. This is the same for all command levels. This router is logging VoIP accounting records too, to the same RADIUS box, without problems.
Have I missed somthing about setting up AAA ?
Grateful for any help!
Thanks
Pete Moore

Even if IOS did support it, the format of any RADIUS cmd accounting will be inferior for a couple of reasons
1) The ACS TACACS+ reports are totally geared up for this with pre-defined columns for each T+ attrbute.
2) ACS has a dedicated cmd accounting report which splits out cmds from sessions
3) To package in RADIUS, IOS would have to create many cisco-av-pair VSA instances. In the RADIUS accounting logs these will all be compressed into a single column of the format
"attr1=value1;attr2=value2;..."
Depending on what you want to do with the data this format is quite restrictive.
My advice is to enable TACACS+
Darran

Accounting records duplicated

For matter of lawful interception I need to find a solution to get duplicated the ASR9000 subscriber pppoe sesion accounting records.
Now it is running XR4.3.2 on the BNGs, soon it will upgrade it to 5.1.3.
In both guide book i have found the command aaa accounting subscriber {list_name| default} {broadcast group {group_name| radius}| group
{group_name| radius}}
I wonder if someone have this command with opcion broadcast group working in your boxes to show me the lines I need to configure.
Regards,
Javier

Hey thanks mate!
You meant if you or the radius in the group never responded or delayed that would adds loads to in my ninek, right now I inferred what you understood.
Let me explain you better. In fact one of the devices in the group will be a Mediation Device (MD) running a radius not for validation but with the only purpose to receive the accounting on and accounting off.
Have you caught the idea?
In other word we need to have all the accounting on-off records duplicated from our nineks, one part of the regular records will be processed for the Radius for validation and accounting, and the other replicated records will be processed for the MD for legally requirements. Maybe it is not the best practice.
Is there a way to do this? I am afraid it is not with that command I described, is it.
Regards,
Javi

AAA Accounting through a NAT device

Good Day to you all,
I am trying to configure aaa accounting through a natted device to a ACS 4.0 server. the information is logged ok but is logged as the device that is performing the natting. is there a way to configure aaa accounting to show the acctual device being updated in the ACS logs

Assuming its RADIUS...
Is it possible to get the originating device to include the NAS-IP-Address or NAS-Identifier attributes in the accounting records?
This will be the actual device values rather than the peer address of the NAT device.

Aaa accounting for config-mode commands

How to account commands entered in config-mode via TACACS+ ?
aaa accounting commands 15 default start-stop group tacacs+
does accounting for all commands in privilege level 15.
Best Regards
Carsten

Carsten
I am not clear what your question is. From the title I gather that you are looking for a way to have accounting records for commands entered in config mode. The answer to the question is to enable accounting for level 15 commands which include the config commands. All of which is included in your message. So what is the question?
If the question is how to get just the config commands without all the other level 15 commands I am not aware of any way to get just the config commands.
HTH
Rick

Server 2012 R2 - The system failed to register host (A or AAAA) resource records (RRs) for network adapter

We seem to be having an issue recently after introducing new Windows Server 2012 R2 servers where they fail to register DNS correctly. The Windows Firewall is off and the servers are on the same VLAN with no firewalls between them.
When I do an ipconfig /registerdns or wait 24 hours for the system to try we get the following error:
The system failed to register host (A or AAAA) resource records (RRs) for network adapter
with settings:
Adapter Name : {4A0ECF05-193F-4BEA-AA46-BEC593BA752B}
Host Name : SRV-DATA
Primary Domain Suffix : internal.local
DNS server list :
192.168.0.50, 192.168.0.42
Sent update to server : <?>
IP Address(es) :
192.168.0.99
The reason the system could not register these RRs was because the DNS server contacted refused the update request. The reasons for this might be (a) you are not allowed to update the specified DNS domain name, or (b) because the DNS server authoritative
for this name does not support the DNS dynamic update protocol.
To register the DNS host (A or AAAA) resource records using the specific DNS domain name and IP addresses for this adapter, contact your DNS server or network systems administrator.
On our DNS server we have set for the internal.local zone Secure Updates only so that looks good because it is Active Directory that should be handling this authentication to update the record I assume. Just to mention that when also doing an ipconfig /regsiterdns
the update fails within a few seconds.
Source: DNS Clients Events
Event ID: 8018
User: NETWORK SERVICE
This issue is only affecting Windows Server 2012 R2 clients and testing with Windows Server 2008 R2 clients works no issues. So is this a mis-configuration or a bug with Windows 2012 R2? I have checked all DNS settings on client / server which all look good
to me so reaching out now to see if anyone has any ideas?
Environment:
- Windows Server 2012 R2 Domain Controllers (Forest/Domain Levels 2012 R2)
- Windows Server 2012 R2 Client machines (Physical and Virtual)
- Windows Server 2008 R2 Client machines (Physical and Virtual)

The zone is configured as "Secure Only"
The PDC is the SOA for the zone
I dont have a packet capture from the DC, only the client.
The query you asked me to run is too long to paste in here, however this is the DNS zone it cannot update:
NotifyServers :
SecondaryServers : {10.2.0.3, 10.2.0.5}
AllowedDcForNsRecordsAutoCreation :
DistinguishedName : DC=internal.local,cn=MicrosoftDNS,DC=ForestDnsZones,DC=internal,DC=local
IsAutoCreated : False
IsDsIntegrated : True
IsPaused : False
IsReadOnly : False
IsReverseLookupZone : False
IsShutdown : False
ZoneName : internal.local
ZoneType : Primary
DirectoryPartitionName : ForestDnsZones.internal.local
DynamicUpdate : Secure
IsPluginEnabled : False
IsSigned : False
IsWinsEnabled : False
Notify : NoNotify
ReplicationScope : Forest
SecureSecondaries : TransferToSecureServers
ZoneFile :
PSComputerName :
CimClass : root/Microsoft/Windows/DNS:DnsServerPrimaryZone
CimInstanceProperties : {DistinguishedName, IsAutoCreated, IsDsIntegrated, IsPaused...}
CimSystemProperties : Microsoft.Management.Infrastructure.CimSystemProperties

Please help me with the accounting records of iTunes. At step in placing credit card details are asked to contact iTunes Support

Please help me with the accounting records of iTunes. At step in placing credit card details are asked to contact iTunes Support

Brenda, the easiest way to contact the support team is thru the iTunes Customer Service website:
http://www.apple.com/support/itunes/contact/

Question about usage of aaa accounting commands

Hi everyone,
I have the problem that Cisco routers and switches do not send some accounting command
information to ACS.
Accounting commands do not send to ACS are "show log" and "show version".
Accounting commands send to ACS are "show runn", "conf t" and "debug"
The configuration of routers and switches is the following
aaa new-model
aaa authentication login default group tacacs+ line
aaa authorization commands 15 default group tacacs+ none
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
tacacs-server host xxx.xxx.xxx.xxx key yyyy
I think the commands do not send to ACS are privilege level 1 command and the commands
send to ACS are privilege level 15 command.
So I need to additional aaa accounting command below to get routers and switches send level 1
command to ACS, because the "15" of "aaa accounting commands 15" does not include level 1
so need to configure "aaa accounting commands 1" for level 1 commands.
aaa accounting commands 1 default start-stop group tacacs+
Is my understanding correct ?
Your information would be greatly appreciated.
Best regards,

Hi,
plese do this and the router will send
everything to the ACS server, except
whatever you are doing to the router in http:
aaa new-model
aaa authentication login notac none
aaa authentication login VTY group tacacs+ local
aaa authentication enable default group tacacs+ enable
aaa authorization console
aaa authorization config-commands
aaa authorization exec notac none
aaa authorization exec VTY group tacacs+ if-authenticated none
aaa authorization commands 0 VTY group tacacs+ if-authenticated none
aaa authorization commands 1 VTY group tacacs+ if-authenticated none
aaa authorization commands 15 VTY group tacacs+ if-authenticated none
aaa authorization network VTY group tacacs+ if-authenticated none
aaa accounting exec VTY start-stop group tacacs+
aaa accounting commands 0 VTY start-stop group tacacs+
aaa accounting commands 1 VTY start-stop group tacacs+
aaa accounting commands 15 VTY start-stop group tacacs+
aaa accounting network VTY start-stop group tacacs+
aaa accounting connection VTY start-stop group tacacs+
aaa session-id common
ip http authentication aaa login-authentication VTY
ip http authentication aaa exec-authorization VTY
tacacs-server host 192.168.15.10 key 7 1446405858517C
tacacs-server directed-request
line con 0
exec-timeout 0 0
authorization exec notac
accounting commands 0 VTY
accounting commands 1 VTY
accounting commands 15 VTY
accounting exec VTY
logging synchronous
login authentication notac
line aux 0
session-timeout 35791
exec-timeout 35791 23
authorization exec notac
accounting commands 0 VTY
accounting commands 1 VTY
accounting commands 15 VTY
accounting exec VTY
login authentication notac
transport input all
line vty 0
exec-timeout 0 0
authorization commands 0 VTY
authorization commands 1 VTY
authorization commands 15 VTY
authorization exec VTY
accounting commands 0 VTY
accounting commands 1 VTY
accounting commands 15 VTY
accounting exec VTY
login authentication VTY
David
CCIE Security

Link from Account record to specific report

Hi,
I have created a single account overview report. Now I want to link from specific account records to that report (embedded analytics).
I have set up the web link but need to change either the link or the report so that it is generated only for the specific account record from where I have clicked the link.
Ideas are highly appreciated.
Thanks!
Søren

Søren,
I have a document that details how to link a report to a webapplet so for each account record you get a report based upon that account. I'm happy to send it to you, but do not want to be spammed, so email me at alex.neill@ (use Homepage details on my profile)
regards
alex

WLC 5508 and AAA accounting

Hello,
Does anyone know if a WLC 5508 can tie into AAA accounting in order to enable departmental chargeback for WLAN services ? (keep track of usage by department, and charge accordingly)

Thank you Nick. (It think you have answered another post of mine)
I feel like all I do is ask ask ask, I need to start answering ?'s ....maybe after a couple hundred posts will I know enough to be helpful

Enable aaa accounting commands for all privilege levels?

Here is the command's syntax:
aaa accounting {auth-proxy | system | network | exec | connection | commands level} {default | list-name} {start-stop | stop-only | none} [broadcast] group groupname
The "command" accounting type must include the privilege level of the commands you are logging. How do I log ALL commands?
Take the following example:
aaa accounting commands 15 default start-stop group mygroup
If I issue this command will that mean commands the user executes that have a privilege level lower than 15 will not be logged? Or only commands that require exactly privilege level 15 will be logged?
How can I log all commands regardless of privilege level?

Hi Red,
If you customize the command privilege level using the privilege command, you can limit which commands the appliance accounts for by specifying a minimum privilege level. The security appliance does not account for commands that are below the minimum privilege level.
The default privilege level is 0. So if you don't specify any privilege level then all should be accounted for.
You can find the command detail at. This is for ASA though.
http://www.cisco.com/c/en/us/td/docs/security/asa/asa80/command/reference/cmd_ref/a1.html#wp1535253
Regards,
Kanwal
Note: Please mark answers if they are helpful.

AAA Accounting Commands

I have just started logging AAA accounting commands on my ACS. I am able to view all commands entered without any trouble. I would like to NOT see commands entered from one particular source. I have an IDS device that shuns to a router. The shunning frequency causes the ACS TACACS+ admin report to become full and unusable. Any ideas on how to exempt commands issued by the IDS?
I have considered setting up multiple vty line configurations. Set up a vty 0 0 and vty 1 4. Configure the vty 0 0 to use something other than the 'default' AAA group. This, of course, assumes that the IDS will always use vty 0 and everyone else will use vty 1 - 4.
Thanks, Rick

Give extraxi aaa-reports! a try (free trial version available)
We offer loads of great canned reports for device admin.. and more importantly you can filter out stuff you dont want during import.
Once the CSVs are imported we also have a visual query builder for drilling down into your data - with the results exportable to word/excel/html etc.
Our csvsync utility can also harvest CSV logs from any number of ACS servers of any version and type (sw & appliance)
We are a Cisco Technology Partner and aaa-reports! is tested "Cisco Compatible"
Darran

WLC8510 AAA Accounting Record

Similar Messages

Maybe you are looking for