What is AAA (Authentication, Authorization, Accounting); what is an accounting record for?

Short answer

AAA is the abbreviation of the three functions of access control: Authentication (who are you?), Authorization (what can you do?) and Accounting (what did you do, and when?). When these functions are gathered on a central server such as TACACS+ or RADIUS, devices are managed with a common policy, not one by one. An accounting record creates an audit trail by keeping on the central server when the user connected and which operations the user performed; incident investigations and compliance reports rely on these records. In TR7, the three functions correspond as follows: authentication is done with Authorization Source in the Device Users form (Local, LDAP, Radius, TACACS), and authorization with User Type; for accounting, TR7 keeps every administrator operation on the User Logs screen, and when Accounting is turned on on the TACACS Settings screen, it also sends the user operation and login logs to the TACACS+ server as accounting records.

Where It Is Used in TR7

Where	Field / label	What for
Settings → User Management → TACACS Settings	Accounting (off by default)	Sending the user operation and login logs to the TACACS+ server as accounting records
Same screen, while Accounting is on	Accounting Username, Accounting Password, Accounting Service Name (default ppp), Accounting Protocol Name (default ip), Accounting Log Language	The service and protocol values of the record, and the language of the log text
Settings → System Logs → User Logs	User Logs	TR7's own accounting record: who, when, from where, what was done
Settings → User Management → Device Users	Authorization Source, User Type	Authentication and authorization

The Three Functions

Function	Question	In TR7
Authentication	Who are you?	Authorization source (Local, LDAP, Radius, TACACS); optional 2FA and client certificate
Authorization	What can you do?	User type and scope fields
Accounting	What did you do, and when?	User Logs; optionally TACACS+ Accounting

Each record sent while Accounting is on is forwarded to the TACACS+ server together with the name of the user who created the record, the service and protocol values, the log ID and the log text in the selected language. If the language of the log text is not selected, the device's default language is used.

Common Misconceptions

• "Accounting is for billing." The term comes from measuring the duration of dial-up connections; in management access, accounting is the audit record of user operations.
• "If Accounting is not turned on, TR7 keeps no records." TR7 keeps administrator operations on the User Logs screen in every case; Accounting ensures that the records are also sent to the central TACACS+ server (Can I see who made changes and when?).
• "Accounting sends only the records of users verified with TACACS+." While Accounting is on, the user operation and login logs are sent regardless of the user's Authorization Source value; the records of users verified with Local, LDAP or RADIUS also reach the TACACS+ server.

How it is done in the documentation

• TACACS Settings · Accounting
• TACACS Settings · What Is It For?
• User Logs · What Is User Logs?

Related questions

• What is TACACS+; how does it differ from RADIUS?
• What is the difference between authentication and authorization?
• What is an audit log; where are administrator actions recorded in TR7?
• Can I see who made changes and when?