Courseiva
AAAGlobal Config

aaa accounting exec default start-stop group tacacs+

Enables AAA accounting for all EXEC shell sessions (user login/logout) and sends accounting records to a TACACS+ server group for auditing or billing.

Definition: aaa accounting exec default start-stop group tacacs+ is a Cisco IOS global config command. Enables AAA accounting for all EXEC shell sessions (user login/logout) and sends accounting records to a TACACS+ server group for auditing or billing.

Overview

The `aaa accounting exec default start-stop group tacacs+` command is a critical component of AAA (Authentication, Authorization, and Accounting) security on Cisco IOS devices. It enables accounting for all EXEC shell sessions—meaning every time a user logs into the router or switch via SSH, Telnet, or console, and when they log out, an accounting record is generated and sent to a TACACS+ server group. This is essential for auditing user activity, tracking who accessed the device and when, and potentially for billing purposes in managed service environments.

The command operates within the broader AAA framework, which typically includes authentication (verifying identity), authorization (determining allowed actions), and accounting (logging activity). Without accounting, you have no record of user sessions, making it impossible to audit security incidents or comply with regulatory requirements. The `default` keyword applies this accounting method to all EXEC sessions by default, meaning it covers any login that isn't explicitly matched by a more specific named list.

The `start-stop` keyword tells the device to send a 'start' accounting record when the session begins and a 'stop' record when it ends, providing a complete log of session duration. The `group tacacs+` specifies that the accounting records should be sent to a TACACS+ server group, which must be previously defined with the `tacacs-server host` command. This command is typically used in environments where centralized AAA is already configured, such as enterprise networks with Cisco ISE or ACS servers.

It is an alternative to using RADIUS for accounting; TACACS+ offers more granular control and encrypts the entire packet, while RADIUS only encrypts the password. In a workflow, you would first configure TACACS+ server hosts and a key, then define a server group, then enable authentication and authorization, and finally add accounting. The command takes effect immediately when entered in global configuration mode, but it does not affect existing sessions—only new ones.

It is important to note that if no TACACS+ server is reachable, the device will still allow EXEC sessions (depending on the authentication fallback), but accounting records will be buffered locally and sent when the server becomes available. The command is available in IOS versions 12.0 and later, and it requires privilege level 15 to configure. It is a fundamental tool for network engineers who need to maintain a secure and auditable access environment.

Syntax·Global Config
aaa accounting exec default start-stop group tacacs+

When to Use This Command

  • Track user login and logout times for security auditing in a corporate network.
  • Generate billing records for customer access to a managed router or switch.
  • Comply with regulatory requirements by logging all administrative access to network devices.
  • Monitor failed login attempts by combining with login authentication failure accounting.

Parameters

ParameterSyntaxDescription
aaa accounting exec default start-stop group tacacs+aaa accounting exec {default | list-name} {start-stop | stop-only | none} [broadcast] group {group-name | radius | tacacs+}The full command syntax. 'default' applies to all EXEC sessions. 'start-stop' sends both start and stop records. 'group tacacs+' specifies the TACACS+ server group. The group must be defined separately with 'aaa group server tacacs+'.

Command Examples

Basic AAA Accounting for EXEC Sessions

aaa accounting exec default start-stop group tacacs+
Router(config)# aaa accounting exec default start-stop group tacacs+
Router(config)#

No output is displayed upon successful configuration. The command enables accounting for all EXEC sessions using the default method list, with start-stop logging to the TACACS+ server group.

Verifying AAA Accounting Configuration

show aaa accounting
AAA Accounting method lists:
  exec        default    start-stop group tacacs+
  commands    default    stop-only group tacacs+
  connection  default    start-stop group tacacs+
  network     default    start-stop group tacacs+
  system      default    start-stop group tacacs+
  resource    default    stop-only group tacacs+

The output lists all configured accounting method lists. The 'exec' line shows that EXEC accounting uses the default list with start-stop mode and TACACS+ group. Other lines show additional accounting types if configured.

Understanding the Output

The 'show aaa accounting' command displays the configured accounting method lists. Each line corresponds to a type of accounting (exec, commands, connection, network, system, resource). The 'default' keyword indicates the method list name.

The mode (start-stop, stop-only, wait-start) defines when records are sent. 'group tacacs+' specifies the server group. In a real network, you would verify that the correct accounting type is present and that the server group matches your TACACS+ configuration.

If no output appears for a type, accounting is not enabled for that activity. Good configuration shows all desired types with correct mode and group. Watch for missing types or incorrect group names that could cause accounting failures.

Configuration Scenarios

Basic TACACS+ Accounting for All EXEC Sessions

A network administrator needs to log all user logins and logouts on a Cisco router for security auditing. The company uses a TACACS+ server (192.168.1.100) for authentication and now wants accounting.

Topology

R1(Gi0/0)---192.168.1.0/24---TACACS+ Server (192.168.1.100)

Steps

  1. 1.Step 1: Enter global configuration mode: configure terminal
  2. 2.Step 2: Configure the TACACS+ server host and key: tacacs-server host 192.168.1.100 key SecretKey123
  3. 3.Step 3: Define a TACACS+ server group: aaa group server tacacs+ MYGROUP, then server 192.168.1.100, then exit
  4. 4.Step 4: Enable AAA globally: aaa new-model
  5. 5.Step 5: Enable EXEC accounting: aaa accounting exec default start-stop group MYGROUP
  6. 6.Step 6: (Optional) Verify with: show aaa accounting
Configuration
! Full IOS config block
Router> enable
Router# configure terminal
Router(config)# tacacs-server host 192.168.1.100 key SecretKey123
Router(config)# aaa group server tacacs+ MYGROUP
Router(config-sg-tacacs+)# server 192.168.1.100
Router(config-sg-tacacs+)# exit
Router(config)# aaa new-model
Router(config)# aaa accounting exec default start-stop group MYGROUP
Router(config)# end

Verify: show aaa accounting displays accounting statistics. Also, check the TACACS+ server logs for start and stop records. Example output: 'Total EXEC accounting records: 5'

Watch out: If the TACACS+ server is unreachable, accounting records are buffered locally but may be lost if the device reloads before sending. Ensure the server is reachable and the key matches.

Accounting with Multiple TACACS+ Servers for Redundancy

An enterprise has two TACACS+ servers for high availability. They want accounting records sent to both servers to ensure no data loss if one fails.

Topology

R1(Gi0/0)---10.0.0.0/24---TACACS+ Server1 (10.0.0.1) R1(Gi0/1)---10.0.1.0/24---TACACS+ Server2 (10.0.1.1)

Steps

  1. 1.Step 1: Enter global configuration mode: configure terminal
  2. 2.Step 2: Configure both TACACS+ servers: tacacs-server host 10.0.0.1 key Key1, tacacs-server host 10.0.1.1 key Key2
  3. 3.Step 3: Define a server group with both servers: aaa group server tacacs+ REDUNDANT, then server 10.0.0.1, server 10.0.1.1, then exit
  4. 4.Step 4: Enable AAA: aaa new-model
  5. 5.Step 5: Enable accounting with broadcast keyword: aaa accounting exec default start-stop broadcast group REDUNDANT
  6. 6.Step 6: Verify with: show aaa servers
Configuration
! Full IOS config block
Router> enable
Router# configure terminal
Router(config)# tacacs-server host 10.0.0.1 key Key1
Router(config)# tacacs-server host 10.0.1.1 key Key2
Router(config)# aaa group server tacacs+ REDUNDANT
Router(config-sg-tacacs+)# server 10.0.0.1
Router(config-sg-tacacs+)# server 10.0.1.1
Router(config-sg-tacacs+)# exit
Router(config)# aaa new-model
Router(config)# aaa accounting exec default start-stop broadcast group REDUNDANT
Router(config)# end

Verify: show aaa servers shows the status of each TACACS+ server. Both should show 'current state: UP' and accounting statistics incrementing.

Watch out: The 'broadcast' keyword sends accounting to all servers in the group, which can increase traffic. Without 'broadcast', only the first server in the group is used unless it fails.

Troubleshooting with This Command

When troubleshooting AAA accounting for EXEC sessions, the first step is to verify that the command is properly configured. Use `show running-config | include aaa accounting exec` to confirm the line is present. If the command is missing, reapply it.

Next, check that the TACACS+ server group is correctly defined with `show aaa group server tacacs+`. Ensure the server IP addresses and keys match the TACACS+ server configuration. A common issue is a key mismatch, which can be diagnosed with `debug tacacs` or `debug aaa accounting`.

Healthy output from `show aaa accounting` should show increasing counters for 'EXEC' accounting records. If counters are not incrementing, the accounting records are not being sent. Check connectivity to the TACACS+ server using `ping` from the router.

If the server is reachable, verify that the TACACS+ service is running and that the router's IP is allowed. Use `debug aaa accounting` to see real-time accounting events. Look for lines like 'AAA/ACCT/EXEC(00000001): start' and 'AAA/ACCT/EXEC(00000001): stop'.

If you see 'AAA/ACCT: send to server failed', it indicates a communication problem. Also, check the TACACS+ server logs for incoming accounting requests. Another symptom is that accounting records are sent but not stored; this could be a server-side issue.

If the router is not sending accounting at all, ensure that `aaa new-model` is enabled. Sometimes, the accounting method list is overridden by a more specific list; use `show aaa method-lists accounting` to see which lists are active. If the 'default' list is not being used, a named list may be matching the user.

Also, verify that the user is authenticated via TACACS+; if local authentication is used, accounting may still work but the username will be local. For session duration issues, check the 'stop' record timestamp. Correlate with `show users` to see active sessions.

If accounting stops working after a configuration change, compare the running config with a known good backup. Finally, remember that accounting records are buffered if the server is unreachable; use `show aaa accounting buffer` to see queued records. If the buffer fills up, old records may be dropped.

In summary, a systematic approach: verify config, check connectivity, enable debugs, inspect server logs, and correlate with other show commands.

CCNA Exam Tips

1.

CCNA exam tip: The 'default' in 'aaa accounting exec default' is the method list name, not a keyword; you can create custom lists like 'aaa accounting exec MYLIST start-stop group tacacs+'.

2.

CCNA exam tip: 'start-stop' sends a 'start' record when the session begins and a 'stop' record when it ends; 'stop-only' sends only a stop record; 'wait-start' delays access until the start record is acknowledged.

3.

CCNA exam tip: AAA accounting does not affect authentication or authorization; it only logs activity. You must also configure 'aaa authentication login' and 'aaa authorization exec' for full AAA.

4.

CCNA exam tip: The TACACS+ server must be reachable and configured with 'tacacs-server host' and 'key' commands, otherwise accounting records will not be sent.

Common Mistakes

Mistake 1: Forgetting to configure the TACACS+ server with 'tacacs-server host' and 'key', causing accounting records to fail silently.

Mistake 2: Using 'stop-only' instead of 'start-stop' when you need both login and logout records, missing the start event.

Mistake 3: Applying the command without also enabling 'aaa new-model', which is required for all AAA commands to take effect.

aaa accounting exec default start-stop group tacacs+ vs aaa new-model

These two commands are commonly confused because both are required for AAA accounting but serve different roles: aaa new-model is the global enabler that activates the AAA security framework, without which no AAA commands are accepted; aaa accounting exec default start-stop group tacacs+ is a specific accounting rule that logs EXEC session activities to a TACACS+ server. They are often considered together when setting up user login auditing.

Aspectaaa accounting exec default start-stop group tacacs+aaa new-model
ScopeEnables AAA security services globally on the deviceEnables accounting specifically for EXEC shell sessions
DependenciesMust be configured before any other AAA command (except aaa new-model itself)Requires aaa new-model to be enabled; also requires a TACACS+ server group
Configuration modeGlobal configurationGlobal configuration
EffectEnables AAA framework; disables default local authentication. Can break management access if not carefulGenerates accounting start/stop records for login/logout events to defined TACACS+ group
Typical useFirst command in AAA deployment; often used with 'aaa authentication login' and 'aaa authorization'Used for auditing or billing by tracking user login/logout times

Use aaa accounting exec default start-stop group tacacs+ when you need to log all user EXEC session durations to a TACACS+ server for security auditing or billing.

Use aaa new-model when you are implementing any AAA services (authentication, authorization, or accounting) and need to enable the AAA security framework as a prerequisite.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 switches), the command syntax is identical to classic IOS. However, the output of `show aaa accounting` may differ slightly, with additional fields like 'Accounting record type'. The NX-OS equivalent is `aaa accounting exec default start-stop group tacacs+` but note that NX-OS uses a different configuration hierarchy; you must first configure the TACACS+ server under `feature tacacs+` and then define the server group.

The exact NX-OS command is the same string, but the underlying server configuration is different. For ASA firewalls, the equivalent command is `aaa accounting exec default start-stop group tacacs+` but ASA uses `tacacs-server` commands differently; the ASA also supports `aaa accounting include` for more granular control. In IOS-XR, the command is `aaa accounting exec default start-stop group tacacs+` but XR uses a different configuration mode (config-aaa) and requires the `tacacs-server` configuration under `tacacs-server host`.

There are no major syntax differences between IOS 12.x, 15.x, and 16.x for this command, but in 16.x (IOS-XE), the `broadcast` keyword behavior may be slightly different; it is recommended to test in a lab. Always check the specific platform documentation for any nuances.

Related Commands

aaa authentication login default group radius local

Configures AAA authentication for login using a RADIUS server group as the primary method, falling back to local authentication if the RADIUS server is unreachable.

aaa authorization exec default group tacacs+ local

Configures AAA authorization for EXEC sessions, using TACACS+ as the primary method and local authentication as fallback, to control user access to the CLI after authentication.

aaa new-model

Enables AAA (Authentication, Authorization, and Accounting) security services on a Cisco device, required before configuring any AAA commands.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions