1.1.8 Set 'aaa accounting connection'

Information

Provides information about all outbound connections made from the network access server.

Rationale:

Authentication, authorization and accounting (AAA) systems provide an authoritative source for managing and monitoring access for devices. Centralizing control improves consistency of access control, the services that may be accessed once authenticated and accountability by tracking services accessed. Additionally, centralizing access control simplifies and reduces administrative costs of account provisioning and de-provisioning, especially when managing a large number of devices. AAA Accounting provides a management and audit trail for user and administrative sessions through RADIUS and TACACS+.

Impact:

Implementing aaa accounting connection creates accounting records about connections from the network access server. Organizations should regular monitor these connection records for exceptions, remediate issues, and report findings regularly.

Solution

Configure AAA accounting for connections.

hostname(config)#aaa accounting connection {default | list-name | guarantee-first}
{start-stop | stop-only | none} {radius | group group-name}

Default Value:

AAA accounting is not enabled.

See Also

https://workbench.cisecurity.org/files/3829

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2(1), CSCv7|16.2

Plugin: Cisco

Control ID: 69dfba1990b0b7f1f1a19eb526a9f34cc0baf07c83921eb4170173c9a500a27e