User's Manual

Fortress ES-Series CLI Guide: Network Security, Authentication and Auditing
164
global default authentication state (Default Auth State) for
controllers.
View the current default authentication state and the list of
authenticating Fortress devices with
show controllerauth:
> show controllerauth
Default Auth State: allow
DeviceID DeviceMac AuthState AdminState
---------------- ----------------- --------- ------
adcd6a989e7b1b9a 00:18:4d:58:85:7b pending active
a11a28d8a54da448 00:30:ab:1b:4f:5d pending active
The default authentication state for detected devices is allow .
Globally configure the setting with
set controllerauth:
# set controllerauth -defaultAuthState allow|pending|deny
Manually add devices for authentication with add
controllerauth
:
# add controllerauth -deviceID <controllerDeviceID> -mac <controllerMACaddr>
-authstate allow|pending|deny -admin active|inactive
NOTE: Display the
Mesh Point’s
Device ID with show
deviceid.
The 16-digit hexadecimal Fortress Device ID automatically
generated for Fortress devices and the device’s MAC address
must be specified in order to manually add a device for
authentication. Device IDs and MAC addresses are not user
configurable; you must specify these values as assigned to the
device you are adding.
The
-authstate switch determines the initial state of the
device’s connection to the encrypted zone:
 pending requires an administrator to change the device’s
authstate setting to allow before it can connect.
 allow (default) permits the device to connect.
 deny blocks connection attempts by the device.
An individual device’s
-authstate overrides the global
authentication state set with
set controllerauth.
Fortress devices have a default administrative state (
-admin)
of
active . You can temporarily suspend a device from
authentication, without deleting its record, by changing
-admin
to
inactive .
Once a device account has been established, use the
update
command interactively, or with the
-deviceID switch, to
reconfigure authentication for the device you specify. The same
switches and arguments used with
add deviceauth (above)
can be used to edit other authentication settings:
# update controllerauth -deviceID <controllerDeviceID>
-authstate allow|pending|deny -admin active|inactive