User's Manual

Fortress ES-Series CLI Guide: Network Security, Authentication and Auditing
171
When more than one MAC address has been added for audit
logging, you can view the individual settings for that MAC
address by specifying it:
# show macaudit -mac 1a2b3c4d5e6f
Add a MAC address for audit logging of associated
administrative activity with
add macaudit:
# add macaudit -mac <MACaddress> -desc <description|“descriptive string”>
-gui required|prohibited|automatic -ssh required|prohibited|automatic
-snmp required|prohibited|automatic -encryptedzone required|prohibited|automatic
-clearzone required|prohibited|automatic -wired required|prohibited|automatic
-wireless required|prohibited|automatic
NOTE: On Mesh
Points without
radios, Wireless inter-
faces and related audit
logging controls are
absent.
The switches following those that specify the MAC address and
optionally provide a description configure how audit logging of
the administrative activity associated with the specified MAC
address will be filtered:
1 by the management interface used to access the Mesh
Point:
-gui, -ssh, -snmp
2 by the zone the MAC address connected from:
-clearzone, -encryptedzone
3 by the physical interfaces the MAC address connected
through:
-wired, -wireless
Because an administrative session associated with a given
MAC address can be defined by more than one of the above
parameters, they are used hierarchically, in the order given
above, to determine whether an event will be audited:
Each parameter can cause a given event to be
required (the
default) for auditing or
prohibited from auditing, and the first
such “hard” setting in the hierarchy of audit parameters
determines whether or not an event is forwarded to the audit
log. Alternatively, auditing can be set to
automatic for any
parameter, which allows an inferior setting in the hierarchy to
determine audit behavior.
Once a MAC address has been added for administrative
auditing, you cannot change it. Use the
-mac switch with the
update command to reconfigure the audit settings for the MAC
address you specify. The same switches and arguments used
with
add macaudit (above) can be used to edit filter settings:
# update macaudit -mac <MACaddress> -desc <description|“descriptive string”>
-gui required|prohibited|
auto -ssh required|prohibited| auto
-snmp required|prohibited|
auto -encryptedzone required|prohibited| auto
-clearzone required|prohibited|
auto -wired required|prohibited| auto
-wireless required|prohibited|
auto
The Mesh Point CLI returns [OK] when settings are
successfully changed.