Smarter by Design.Simpler for Business
settings access
The settings access command configures the management access of the device: it determines which service will be listened on which address and port, which networks it can be accessed from, the sign-in protections and the session durations.
A wrong setting can cut off the management access
This command changes the path the device is connected over. Giving the listening address, the port or the allowed network list wrongly cuts the current session as well as possibly preventing reconnection. An alternative access path must be ready before the change.
Command Summary
# Tab after the command
admin@TR7LBWAF01> settings access
init reset show update
admin@TR7LBWAF01> settings access show # show the settings
admin@TR7LBWAF01> settings access update … # change
admin@TR7LBWAF01> settings access init # set up the access
admin@TR7LBWAF01> settings access reset # return to the default
admin@TR7LBWAF01>
This resource is a single setting: no identifier is written, update is run directly and only the fields to be changed are given.
The Common Structure of the Services
All five of the management services (HTTP, HTTPS, SSH, FTP, SNMP) use the same two lists:
| List | What it does | The field format |
|---|---|---|
| The listening addresses | Determines on which address and port the service will be served | --<service>.N.ip and --<service>.N.port |
| The allowed networks | Limits which networks the service can be accessed from | --<service>AllowedNetworks.N.ip and --<service>AllowedNetworks.N.cidr |
Both lists are indexed: more than one address or network is written with its own index. The allowed network lists take at most 10 entries.
The addresses that can be selected as a listening address are limited to the addresses defined on the ethernet interfaces in the default routing table.
HTTP
| Field | What it does | What is written after it |
|---|---|---|
--http.N.ip | Determines the address the HTTP management access will be listened on | An address defined on the device; every listening entry with its own index |
--http.N.port | Determines the port that entry will be listened on | A port number (the example value is 80) |
--httpAllowedNetworks.N.ip | Determines the address of the network that is allowed HTTP access | A network address |
--httpAllowedNetworks.N.cidr | Determines the mask length of that network | A CIDR value |
HTTPS
| Field | What it does | What is written after it |
|---|---|---|
--https.N.ip | Determines the address the HTTPS management access will be listened on | An address defined on the device |
--https.N.port | Determines the port that entry will be listened on | A port number (the example value is 443) |
--httpsAllowedNetworks.N.ip | Determines the address of the network that is allowed HTTPS access | A network address |
--httpsAllowedNetworks.N.cidr | Determines the mask length of that network | A CIDR value |
--httpsCert | Selects the certificate that will be served on HTTPS | A certificate record |
--httpsMinSslVersion | Determines the lowest TLS version that will be accepted | SSLv3 · TLSv1.0 · TLSv1.1 · TLSv1.2 · TLSv1.3 |
--httpsMaxSslVersion | Determines the highest TLS version that will be accepted | The same version values; it cannot be smaller than the lowest version |
The last three fields are listed only while at least one HTTPS listening address is defined.
SSH
| Field | What it does | What is written after it |
|---|---|---|
--ssh.N.ip | Determines the address the SSH access will be listened on | An address defined on the device |
--ssh.N.port | Determines the port that entry will be listened on | A port number (the example value is 22) |
--sshAllowedNetworks.N.ip | Determines the address of the network that is allowed SSH access | A network address |
--sshAllowedNetworks.N.cidr | Determines the mask length of that network | A CIDR value |
--sshSessionDur.val | Determines after how long without an operation the SSH session will be dropped | A number |
--sshSessionDur.unit | Selects the unit of that duration | m (the default) · h · d · w · M |
FTP
| Field | What it does | What is written after it |
|---|---|---|
--ftp.N.ip | Determines the address the FTP access will be listened on | An address defined on the device |
--ftp.N.port | Determines the port that entry will be listened on | A port number (the example value is 21) |
--ftpAllowedNetworks.N.ip | Determines the address of the network that is allowed FTP access | A network address |
--ftpAllowedNetworks.N.cidr | Determines the mask length of that network | A CIDR value |
--ftpPassivePortRange.start | Determines the start of the port range the passive mode data connections will use | An integer between 1024 and 65535 (the default is 40000) |
--ftpPassivePortRange.end | Determines the end of the same range | An integer between 1024 and 65535 (the default is 40023) |
SNMP
| Field | What it does | What is written after it |
|---|---|---|
--snmp.N.host | Selects on which device that listening entry will be opened | A device; the default is the device the command runs on |
--snmp.N.ip | Determines the address the SNMP access will be listened on | An address defined on the selected device |
--snmp.N.port | Determines the port that entry will be listened on | A port number (the example value is 161) |
--snmpAllowedNetworks.N.ip | Determines the address of the network that is allowed SNMP access | A network address |
--snmpAllowedNetworks.N.cidr | Determines the mask length of that network | A CIDR value |
--snmp_v1 | Turns on answering the version 1 queries | true · false (the default is false) |
--snmp_v2 | Turns on answering the version 2 queries | true · false (the default is false) |
--snmp_v3 | Turns on answering the version 3 queries | true · false (the default is false) |
--snmp_v2_communityName | Determines the community name that will be verified on version 2 | A community name |
--snmp_v3_userPassList.N.username | Determines the name of the version 3 user | A user name; every user with its own index |
--snmp_v3_userPassList.N.authProtocol | Selects the authentication and encryption method of that user | SHA — SHA + AES (authPriv), the default · MD5 — MD5 (authNoPriv) |
--snmp_v3_userPassList.N.password | Determines the password of that user | A password |
The version switches are listed only while at least one SNMP listening address is defined. The community name is opened while --snmp_v2 true and the user list while --snmp_v3 true.
The Sign-in Protection
| Field | What it does | What is written after it |
|---|---|---|
--tr7ServerCaptcha | Turns on the CAPTCHA verification on the management interface sign-in | true · false (the default is false) |
--tr7ServerCaptchaDifficulty | Selects the CAPTCHA difficulty level | 1 — Easy (the default) · 2 — Medium · 3 — Hard. Only while --tr7ServerCaptcha true |
--2fa | Turns on the two-factor authentication | true · false (the default is false) |
--2faMethods | Selects which channel the second factor will be asked over | email (the default) · sms |
--2faUserTypes.N | Selects which user types the second factor will be asked from | superAdmin; the only type defined in this version |
--2faExcludedUsers.N | Selects the users that will be exempt from the second factor | User records; each of them with its own index |
--2faNoContactPolicy | Selects what will be done to a user that does not have a contact address defined | block prevents the sign-in (the default) · allow lets them through without asking for a second factor |
The last four fields are listed only while --2fa true.
The Session and Failed Login Limits
| Field | What it does | What is written after it |
|---|---|---|
--tr7ServerSessionDur.val | Determines after how long without an operation the management interface session will be dropped | A number (the default is 3) |
--tr7ServerSessionDur.unit | Selects the unit of that duration | m · h (the default) · d; the total duration cannot exceed 24 hours |
--failedLoginExpiresIn.val | Determines how long the failed login quarantine will last | A number (the default is 3) |
--failedLoginExpiresIn.unit | Selects the unit of that duration | m · h (the default) · d; the total duration cannot exceed 7 days |
--maxFailedLoginPerIp | Determines how many failed logins will be allowed from one address | An integer between 0 and 1000 |
--maxFailedLoginPerIpUsername | Determines how many failed logins will be allowed for one address and user name pair | An integer between 0 and 1000 |
The Other Accesses
| Field | What it does | What is written after it |
|---|---|---|
--innerWaf | Turns on the filtering of the requests coming to the management API — its name in the interface is API Access Filter (Beta) | true · false (the default is false) |
--prometheusAllowedNetworks.N.ip | Determines the address of the network that will be able to access the metrics endpoint | A network address |
--prometheusAllowedNetworks.N.cidr | Determines the mask length of that network | A CIDR value |
--systemUsers.N.username | Selects the system user whose authorization will be edited | log · config_backup · ip_intelligence · update; the same user cannot be written twice |
--systemUsers.N.ftp | Turns on the FTP access of that user | true · false (the default is false) |
--systemUsers.N.ssh | It is the field that turns on the SSH access of the system user | Since there is no system user with SSH authorization defined in this version, the field is not activated on any user selection |
What the system users are for
Each of the four system users corresponds to a file exchange: log is the FTP folder used for the log files, config_backup for the backups, ip_intelligence for the address reputation lists and update for the update packages.
init and reset
These two sub-commands set up the management access itself or return it to the default. There are no options on the CLI nodes: the commands are run without a field being written.
| Sub-command | What it does |
|---|---|
init | It starts or reconfigures the access settings. According to the endpoint explanation the interface must be an ethernet interface in the default routing table; the address must be a valid IPv4 address without the CIDR notation. The changes take effect immediately and can temporarily cut the management connection |
reset | It resets the access settings to their default configuration. After the reset, in order to establish the connection, the access settings may need to be reconfigured with init |
Both of them can cut off the access
The endpoint explanations carry the same warning for both operations: the changes take effect immediately and can cut the management connection. An alternative access path must be ready before running them.
Examples
admin@TR7LBWAF01> settings access update \
--https.0.ip <address> --https.0.port 443 --httpsCert <certificate> \
--httpsMinSslVersion TLSv1.2 --httpsMaxSslVersion TLSv1.3 \
--httpsAllowedNetworks.0.ip 10.0.1.0 --httpsAllowedNetworks.0.cidr 24
admin@TR7LBWAF01>
admin@TR7LBWAF01> settings access update --tr7ServerCaptcha true --tr7ServerCaptchaDifficulty 2 \
--maxFailedLoginPerIp 10 --maxFailedLoginPerIpUsername 5 \
--failedLoginExpiresIn.val 1 --failedLoginExpiresIn.unit h \
--tr7ServerSessionDur.val 30 --tr7ServerSessionDur.unit m
# the two-factor authentication
admin@TR7LBWAF01> settings access update --2fa true --2faMethods email \
--2faUserTypes.0 superAdmin --2faNoContactPolicy block
admin@TR7LBWAF01>
admin@TR7LBWAF01> settings access update --snmp.0.ip <address> --snmp.0.port 161 \
--snmp_v3 true --snmp_v3_userPassList.0.username viewer \
--snmp_v3_userPassList.0.authProtocol SHA --snmp_v3_userPassList.0.password <password>
# removing a single entry · emptying the list
admin@TR7LBWAF01> settings access update --httpAllowedNetworks.1.delete
admin@TR7LBWAF01> settings access update --http.delete
admin@TR7LBWAF01>
Things to Know
- If the listening list is emptied, the service is not served. When the list is emptied with
--<service>.delete, the access to that service is closed; before closing the HTTP management access this way, it must be verified that the HTTPS or SSH path is open. - The certificate and the TLS versions depend on the HTTPS list.
--httpsCert,--httpsMinSslVersionand--httpsMaxSslVersionare not listed while at least one HTTPS listening address is not defined. - The SNMP version switches also depend on the list.
--snmp_v1,--snmp_v2and--snmp_v3are not opened while at least one SNMP listening address is not defined. - The sub-fields of the two-factor authentication are conditional. The channel, the user types, the exempt users and the contact address policy appear only while
--2fa true. - If the allowed network list is left empty, no limit is applied. When the list is not defined, the service is open to all the requests that can reach the address it listens on. Every list takes at most 10 entries.
- The address selection is limited to the default routing table. Only the addresses defined on the ethernet interfaces in that table can be selected as a listening address; the addresses are defined with
network ip. initandresetare commands without options. There are no fields on the CLI nodes; both of them are operations that can cut the management connection.- The list fields can be deleted one by one or all at once.
--<field>.N.deleteremoves a single entry, and--<field>.deleteempties the list.
