| 11.3 |  | Authorization and Accounting Configuration |
| 11.3.3 |  | Configuring the PIX Security Appliance to support AAA accounting |

| Now that authentication and authorization have been examined, AAA accounting will be discussed. This section explains how to enable and configure accounting for the following:

- All services for
- Specific services for
- No services

As with the first two components of AAA, the PIX Security Appliance also supports AAA accounting services. The AAA networking account structure is shown in Figure . Remember that the primary functions of AAA are as follows:

- Authentication asks who the user is
- Authorization determines what the user can do
- Accounting records what the user has done

Accounting services are useful to a network administrator for two primary reasons:

- First, accounting lets administrators know what services are being used. This information can be used to modify an existing security policy. It can also help in determining the current and future allocation of resources, such as bandwidth, servers, or routers.
- Second, if an application or service is misused, the accounting record provides proof of what happened and makes it easier for a company to pursue disciplinary or legal action.

aaa accounting command
AAA accounting is enabled on the PIX Security Appliance with the aaa accounting command, which is similar in syntax and scope to both the aaa authentication and aaa authorization commands. The aaa accounting command includes the same options as the other two commands:

- The ability to include or exclude accounting of specific service such as FTP, HTTP, and Telnet
- The ability to apply accounting to either inbound or outbound connections

Like authorization, the accounting process is transparent to end users. Also, like the aaa authorization command, AAA accounting on the PIX works with traffic that is not non-FTP, non-Telnet, and non-HTTP traffic. Again, this is done by allowing the administrator to set accounting services by protocol or by port number.

| Lab Activity e-Lab Activity: Authorization Configuration In this activity, the student will enable authorization and accounting.

| Resources How to View Accounting Information in CSACS