User's Manual

Fortress ES-Series CLI Guide: Network Security, Authentication and Auditing
156
authentication for the device you specify. The same switches
and arguments used with
add deviceauth (above) can be
used to edit other authentication settings:
# update deviceauth -deviceID <deviceID> -userAuth y|n -name <deviceName>
-mode allowfirst|denyall|defer -admin active|inactive
-keysize DH512|DH1024|DH2048|suiteB
In addition, after a device has been added to device
authentication and allowed to connect, you can specify the key
establishment method(s) the device will be allowed to use for
subsequent connections with
-keysize.
You can delete a specified device from authentication or all
configured devices with the
del command:
# del deviceauth -all|-deviceID <deviceID>
You must be logged on to an administrator -level account to
change configuration settings (refer to Section 2.2).
4.5.5 Session Idle Timeouts
When idle sessions are timed out by the Mesh Point, affected
devices must re-establish their connections and reauthenticate
on the encrypted network. When the Mesh Point is configured
to permit cached authentication credentials (the default,
Section 4.1.15), the Mesh Point uses cached credentials to
reauthenticate the users of timed-out devices transparently.
Idle timeouts for host devices—devices connecting from the
clear zone—can only be set globally.
Idle timeouts for Secure Client devices can be set at the same
global level as host idle timeouts, but when the internal
authentication server is enabled (Section 4.5.2), the local
global setting overrides the overall global setting (as displayed
and configured with the
show and set idletimeout
commands described below).
Use
show idletimeout to display Secure Client and host idle-
timeout settings:
# show idletimeout
clients: 30 minutes
hosts: 30 minutes
The output above shows the Mesh Point’s default, 30-minute
idle timeout values.
You can configure session timeout values globally for all
devices, globally for a particular device type (clients or hosts)
or for individual devices, identified by their MAC addresses. Set
timeouts in minutes from
1 to 43200, or enter 0 (zero) to disable
the timeout function.
Set the timeout value for all connected devices on both the
encrypted and clear sides of the network by entering only the