186 Configuring Authentication, Authorization, and Accountingprofiles have an implicit “deny all” rule, such that any command that doesnot match any rule in the profile is considered to have been denied by thatprofile.A user can be assigned to more than one profile. If there are conflicting rulesin profiles, the “permit” rule always takes precedence over the “deny” rule.That is, if any profile assigned to a user permits a command, then the user ispermitted access to that command. A user may be assigned up to 16 profiles.A number of profiles are provided by default. These profiles cannot be alteredby the switch administrator. See "Administrative Profiles" on page 204 for thelist of default profiles.If the successful authorization method does not provide an administrativeprofile for a user, then the user is permitted access based upon the user'sprivilege level. This means that, if a user successfully passes enableauthentication or if exec authorization assigns a privilege level, the user ispermitted access to all commands. This is also true if none of theadministrative profiles provided are configured on the switch. If some, butnot all, of the profiles provided in the authentication are configured on theswitch, then the user is assigned the profiles that exist, and a message islogged that indicates which profiles could not be assigned.AccountingAccounting is used to record security events, such as a user logging in orexecuting a command. Accounting records may be sent upon completion ofan event (stop-only) or at both the beginning and end of an event (start-stop). There are three types of accounting: commands, dot1x, and exec.• Commands—Sends accounting records for command execution.• Dot1x—Sends accounting records for network access.• Exec—Sends accounting records for management access (logins).For more information about the data sent in accounting records, see "WhichRADIUS Attributes Does the Switch Support?" on page 198 and "UsingTACACS+ Servers to Control Management Access" on page 201.Table 9-4 shows the valid methods for each type of accounting:
