User's Manual

Fortress ES-Series CLI Guide: Network Security, Authentication and Auditing
147
The maximum number of authentication retries
(
DefaultMaxRetries) and idle and session timeout settings
(
DefaultIdleTimeout and DefaultSessionTimeout)
configured on the internal authentication server are applied
globally to all authenticating devices and users.
A device that exceeds the maximum allowable retry attempts to
authenticate on the Mesh Point is locked out until the device’s
individual authentication mode is set to
allowfirst Such a
device is locked out on every Mesh Point in a network, and you
must change the device’s authentication mode on every Mesh
Point that handles traffic from the device.
Users who exceed the maximum allowable retry attempts to
log on to the Fortress-secured network are locked out until you
reset their sessions. On a network of Mesh Points, you must
reset the session on each Mesh Point that passes traffic for the
device.
Specify maximum authentication retries in whole numbers
between
1 and 255 ; the default is 3 . Specify idle and session
timeouts in minutes: between
1 and 720 for idle timeouts, and 1
and
200; for session timeouts. 0 (zero) disables the timeout
setting. The default session timeout is
30 minutes. The default
idle timeout is
30 minutes.
4.5.2.4 Local 802.1X Authentication Settings
The Mesh Point’s internal RADIUS server can be configured to
authenticate 802.1X supplicant credentials using two possible
EAP (Extensible Authentication Protocol) types.
NOTE: EAP-TLS
provides a signifi-
cantly higher level of
security than EAP-MD5 .
EAP-MD5 verifies an MD5 (Message-Digest algorithm 5) hash
of each user’s password, which requires a user’s credentials to
be present in the Mesh Point’s local user authentication service
before the local 802.1X service can authenticate that user.
Refer to Section 4.5.3 for guidance.
In order to use EAP-TLS (EAP with Transport Layer Security)
public key cryptography authentication, you must import a valid
EAP-TLS digital certificate for the local service and the root CA
(Certificate Authority) certificate that signs the local server
certificate. You must also import any root CA certificate(s) used
to sign supplicant certificates, so that the local server can verify
their authenticity. Refer to Section 4.2 for guidance. Additional
local server configuration settings in
set localauth apply only
to EAP-TLS, as noted below.
Enable8021xAuth[N] (Y|N to enable|disable 802.1x authentication):
EnableEAP-MD5 (Y|N to enable|disable support for EAP-MD5 protocol):
EnableEAP-TLS (Y|N to enable|disable support for EAP-TLS protocol):
EnableCRLCheck[N] (Y|N to enable|disable CRL check):
TLSCipher (all|legacy|suiteb to set supported cipher suite for EAP-TLS):