User's Manual

Fortress ES-Series CLI Guide: Network Security, Authentication and Auditing
118
You can turn off GUI access to the Mesh Point altogether by
disabling the user interface. The Mesh Point GUI is enabled by
default.
You can view the current GUI access setting with
show gui:
> show gui
Status: On
SSL Private Key: ssl_auto_key
Require client certificate: no
Auto Logon client certificate: no
If you want to limit access to the Fortress Mesh Point
exclusively to the Mesh Point CLI, you can disable the Mesh
Point GUI, as follows:
# set gui off
To re-enable the Mesh Point GUI, enter:
# set gui on
You can use the -key switch to indicate or change the private
key and client certificate to use for SSL sessions:
# set gui -key <keyname>
Use the -nokey switch to clear the encryption key currently in
use:
# set gui -nokey
If you want to require the GUI client to present a digital
certificate to be authenticated before being permitted access,
set
-requireClientCertificate to enabled .:
# set gui -requireClientCertificate enabled
[OK] Note: You must restart the controller for client authentication changes to take effect.
Turn this functionality back off with the same command:
# set gui -requireClientCertificate disabled
[OK] Note: You must restart the controller for client authentication changes to take effect.
NOTE: When SSO
is configured, if
the Mesh Point is also
configured to authenti-
cate with a RADIUS
server rather than with
local authentication, the
user must enter user-
name and password the
first time the certificate
Common Name user
tries to logon. This is
necessary in order to
populate the local
authentication cache.
As the prompt informs you, you must reboot the Mesh Point in
order to put a change to
-requireClientCertificate into
effect: refer to Section 5.2.
If you want to automatically log in GUI users who have
presented a valid certificate, without requiring them to enter
user name and password, set
-clientCertificateSignOn to
enabled:
# set gui -clientCertificateSignOn enabled
You must also require the GUI client to present a digital
certificate;
-requireClientCertificate must be enabled if
-clientCertificateSignOn is enabled. This feature is most
useful when Common Access Cards (CAC) are used, but any
X509 client certificate may be used as long as the Common
Name (CN) contains the user name.