1.测试拓扑：
上面链接有如下文字，说明是在记账是才用的上：
RADIUS servers normally check the source IP address in the IP header of the RADIUS packets to track the source of the RADIUS requests and to maintain security. The NAT or PAT solution satisfies these requirements because only a single source IP address is used even though RADIUS packets come from different NAS routers.
However, when retrieving accounting records from the RADIUS database, some billing systems use RADIUS attribute 4, NAS-IP-Address, in the accounting records. The value of this attribute is recorded on the NAS routers as their own IP addresses. The NAS routers are not aware of the NAT or PAT that runs between them and the RADIUS server; therefore, different RADIUS attribute 4 addresses will be recorded in the accounting records for users from the different NAS routers. These addresses eventually expose different NAS routers to the RADIUS server and to the corresponding billing systems
2.基本配置： R1： interface FastEthernet0/0 ip address 10.1.1.1 255.255.255.0 no shut interface Loopback0 ip address 1.1.1.1 255.255.255.0 ip route 0.0.0.0 0.0.0.0 10.1.1.3R2： interface FastEthernet0/0 ip address 10.1.1.2 255.255.255.0 no shut interface Loopback0 ip address 2.2.2.2 255.255.255.0 ip route 0.0.0.0 0.0.0.0 10.1.1.3R3: interface Ethernet0/0 ip address 10.1.1.3 255.255.255.0 ip nat inside no shut interface Ethernet0/1 ip address 100.1.1.1 255.255.255.0 ip nat outside no shut access-list 10 permit 10.1.1.0 0.0.0.255 ip nat inside source list 10 interface Ethernet0/1 overloadACS:①添加AAA client： ②添加认证用户： ③开启Radius记账： 3.NAS的Radius配置：①开启AAA,并做线下保护： aaa new-model aaa authentication login noacs line none line con 0 login authentication noacs line aux 0 login authentication noacs②认证： radius-server host 100.1.1.100 auth-port 1645 acct-port 1646 key cisco aaa authentication login acs group radius line none line vty 0 5 login authentication acs③授权： aaa authorization exec default group radius if-authenticated aaa authorization network default group radius④记账： aaa accounting exec default start-stop group radius aaa accounting exec acs start-stop group radius aaa accounting network default start-stop group radius aaa accounting connection default start-stop group radius aaa accounting system default start-stop group radius⑤测试： test aaa group radius ccsp 1234qwer new-code4.登录测试：①从R2上telnetR1： R2#telnet 10.1.1.1 Trying 10.1.1.1 ... Open User Access Verification Username: ccsp Password: R1>②下面为debug信息： -----从debug信息可以看到12.4的IOS默认是带有NAS-IP-Address 的Radius-----否则从ACS上记录就不是NAS设备的接口地址，而是PAT后的地址
attribute 的:
R1#debug radius Radius protocol debugging is on Radius protocol brief debugging is off Radius protocol verbose debugging is off Radius packet hex dump debugging is off Radius packet protocol debugging is on Radius elog debugging debugging is off Radius packet retransmission debugging is off Radius server fail-over debugging is off Radius elog debugging debugging is off R1# *Mar 1 01:37:43.731: RADIUS/ENCODE(0000000C): ask "Username: " *Mar 1 01:37:43.731: RADIUS/ENCODE(0000000C): send packet; GET_USER R1# *Mar 1 01:37:45.815: RADIUS/ENCODE(0000000C): ask "Password: " *Mar 1 01:37:45.815: RADIUS/ENCODE(0000000C): send packet; GET_PASSWORD R1# *Mar 1 01:37:48.519: RADIUS/ENCODE(0000000C):Orig. component type = EXEC *Mar 1 01:37:48.523: RADIUS: AAA Unsupported Attr: interface [174] 5 *Mar 1 01:37:48.523: RADIUS: 74 74 79 [tty] *Mar 1 01:37:48.523: RADIUS/ENCODE(0000000C): dropping service type, "radius-server attribute 6 on-for-login-auth" is off *Mar 1 01:37:48.527: RADIUS(0000000C): Config NAS IP: 0.0.0.0 *Mar 1 01:37:48.527: RADIUS/ENCODE(0000000C): acct_session_id: 10 *Mar 1 01:37:48.527: RADIUS(0000000C): sending *Mar 1 01:37:48.531: RADIUS/ENCODE: Best Local IP-Address 10.1.1.1 for Radius-Server 100.1.1.100 *Mar 1 01:37:48.535: RADIUS(0000000C): Send Access-Request to 100.1.1.100:1645 id 1645/11, len 79 *Mar 1 01:37:48.535: RADIUS: authenticator 23 FF FD 4D FB FF EE 28 - 90 ED 86 BD FE 99 6A 34 *Mar 1 01:37:48.539: RADIUS: User-Name [1] 6 "ccsp" *Mar 1 01:37:48.539: RADIUS: User-Password [2] 18 * *Mar 1 01:37:48.539: RADIUS: NAS-Port [5] 6 66 *Mar 1 01:37:48.539: RADIUS: NAS-Port-Id [87] 7 "tty66" *Mar 1 01:37:48.543: RADIUS: NAS-Port-Type [61] 6 Virtual [5] *Mar 1 01:37:48.543: RADIUS: Calling-Station-Id [31] 10 "10.1.1.2" *Mar 1 01:37:48.543: RADIUS: NAS-IP-Address [4] 6 10.1.1.1 *Mar 1 01:37:48.615: RADIUS: Received from id 1645/11 100.1.1.100:1645, Access-Accept, len 49 *Mar 1 01:37:48.619: RADIUS: authenticator BC 45 8F DA 54 02 5B B1 - 2E 2F B9 E0 09 03 3B 24 *Mar 1 01:37:48.619: RADIUS: Framed-IP-Address [8] 6 255.255.255.255 *Mar 1 01:37:48.619: RADIUS: Class [25] 23 *Mar 1 01:37:48.623: RADIUS: 43 41 43 53 3A 30 2F 35 62 37 2F 61 30 31 30 31 [CACS:0/5b7/a0101] *Mar 1 01:37:48.623: RADIUS: 30 31 2F 36 36 [01/66] *Mar 1 01:37:48.655: RADIUS(0000000C): Received from id 1645/11 *Mar 1 01:37:48.667: RADIUS/ENCODE(0000000C):Orig. component type = EXEC *Mar 1 01:37:48.671: RADIUS(0000000C): Config NAS IP: 0.0.0.0 *Mar 1 01:37:48.671: RADIUS(0000000C): sending *Mar 1 01:37:48.675: RADIUS/ENCODE: Best Local IP-Address 10.1.1.1 for Radius-Server 100.1.1.100 *Mar 1 01:37:48.679: RADIUS(0000000C): Send Accounting-Request to 100.1.1.100:1646 id 1646/9, len 118 *Mar 1 01:37:48.679: RADIUS: authenticator 89 C8 38 B4 FD DF 2D 53 - 30 08 B6 70 30 81 45 41 *Mar 1 01:37:48.679: RADIUS: Acct-Session-Id [44] 10 "0000000A" *Mar 1 01:37:48.679: RADIUS: User-Name [1] 6 "ccsp" *Mar 1 01:37:48.683: RADIUS: Acct-Authentic [45] 6 RADIUS [1] *Mar 1 01:37:48.683: RADIUS: Acct-Status-Type [40] 6 Start [1] *Mar 1 01:37:48.683: RADIUS: NAS-Port [5] 6 66 *Mar 1 01:37:48.687: RADIUS: NAS-Port-Id [87] 7 "tty66" *Mar 1 01:37:48.687: RADIUS: NAS-Port-Type [61] 6 Virtual [5] *Mar 1 01:37:48.687: RADIUS: Calling-Station-Id [31] 10 "10.1.1.2" *Mar 1 01:37:48.687: RADIUS: Class [25] 23 *Mar 1 01:37:48.691: RADIUS: 43 41 43 53 3A 30 2F 35 62 37 2F 61 30 31 30 31 [CACS:0/5b7/a0101] *Mar 1 01:37:48.691: RADIUS: 30 31 2F 36 36 [01/66] *Mar 1 01:37:48.691: RADIUS: Service-Type [6] 6 NAS Prompt [7]*Mar 1 01:37:48.695: RADIUS: NAS-IP-Address [4] 6 10.1.1.1 *Mar 1 01:37:48.695: RADIUS: Acct-Delay-Time [41] 6 0 *Mar 1 01:37:48.783: RADIUS: Received from id 1646/9 100.1.1.100:1646, Accounting-response, len 20 *Mar 1 01:37:48.783: RADIUS: authenticator 99 06 C5 F8 12 E7 D8 60 - EC 21 E8 B4 47 03 98 1C③查看ACS上面的记账： 5.修改NAS的的Radius配置，设置NAS-IP-Address 属性： ①配置命令： R1(config)#radius-server attribute 4 1.1.1.1 R2(config)#radius-server attribute 4 2.2.2.2②重新登录测试，查看ACS上面的记账：