ADMINISTRATION
After you completed your Self-Diagnostic configuration (selecting any or all of the above):
1.
Click Submit .
2.
To save changes, click Save and Restart .
If at any time you want to return the device to the default setting, click the Reset to Default button in the bottom right corner. (This disables or removes all enabled Self-Diagnostic features.)
Configuring Device Access
This section contains configurations that determine how the device can be accessed as well as security features that decrease susceptibility to malicious activity.
To display the Access Configuration window containing the fields described below, go to Administration > Access
Configuration .
HTTP Redirect to HTTPS
The device allows only secure access to its Web UI. This set of rules automatically redirects HTTP requests to the device's secure HTTPS port.
Field
Enabled
Port
Via LAN/Ethernet
Via WAN/Cellular
Description
Enables HTTP to HTTPS redirect which automatically redirects users trying to access the device via HTTP to
HTTPS.
The port on which the device listens for HTTP requests to redirect.
If checked, the device listens and redirects HTTP requests to HTTPS from the LAN.
If checked, the device listens and redirects HTTP requests to HTTPS from the WAN.
HTTPS
The device provides secure Web UI access to modify its configurations and execute actions.
Field Description
Port
Via WAN/Cellular
Session Timeout ( under Authorization)
The port on which the device will listen for HTTPS requests.
If checked, the device will listen and respond to HTTPS requests from the WAN. This increases susceptibility to malicious activity.
Amount of time a user's session can remain dormant before automatically being logged out (minutes).
HTTPS Security
Configure the HTTPS security settings (like version and cipher suite). Click the Show link to the right under HTTPS
Security . To enable the Web server to authenticate the client via the client’s public key certificate, check Client
Authentication under the Authentication section.
mPower TM Edge Intelligence Conduit AEP Software Guide 93
ADMINISTRATION
Note: Enabling Client Authentication can prevent users from accessing the Web UI. When Client Authentication is enabled it is required that a web browser has a valid client certificate that is signed by a CA that the server can verify. The CA certificate needs to be uploaded to the device using the upload feature at Administration > X.509
CA Certificates . Configure TLS version and cipher suites under the TLS Settings section.
Description Field
Authentication
Client Authentication Requires web browsers to have a valid client certificate that is signed by a Certifying Authority (CA) that the server can verify. Otherwise, user access to the UI is blocked.
NOTE: You must first upload a CA certificate at
Administration > X.509 CA Certificates.
TLS Settings
Use default cipher suite
TLS 1.2 or TLS 1.1
Cipher Suite Name
Enables use of the default cipher (check by default). No other user input is required.
Check which version of the TLS protocol you want to use: TLS 1.2 or TLS 1.1. Default: TLS 1.2 ( Use default cipher suite must be unchecked.)
Check your preferred Cipher Suite from the following list: ECDHE-RSA-AES256-GCM-SHA384,ECDHE-RSA-
AES256-SHA, DHE-RSA-AES256-GCM-SHA384, AES256-
SHA, ECDHE-RSA-AES128-GCM-SHA256,ECDHE-RSA-
AES128-SHA, DHE-RSA-AES128-GCM-SHA256, DHE-
RSA-AES128-SHA, and/or AES128-SHA . Default:
AES128-SHA ( Use default cipher suite must be unchecked.)
SSH
The device's internal system can be accessed securely via SSH. This is intended for advanced troubleshooting and/or custom deployment solutions.
Field
Enabled
Port
Via LAN/Ethernet
Via WAN/Cellular
Description
Enables SSH redirect which automatically redirects users trying to access the device via SSH (disabled by default).
The port on which the device listens for SSH requests.
If checked, the device listens and responds to SSH requests from the LAN.
If checked, the device listens and respond to SSH requests from the WAN.
Reverse SSH Tunnel
Enable and configure a reverse SSH tunnel.
94 mPower TM Edge Intelligence Conduit AEP Software Guide
ADMINISTRATION
Field
Enabled
Server
Remote Port
Username
Authentication Method
Password
Public Key
Private Key
Description
Enable Reverse SSH tunnel to get SSH access to the device with a public IP address.
Remote SSH server IP address or hostname to which the reverse SSH tunnel connection is established.
Tunnel remote port that opens on the remote end of the reverse SSH tunnel connection (2222 by default).
Remote SSH server username.
Defines Authentication method to use for Reverse SSH
Tunnel . Select from drop-down including Password ,
Public Key , or Private Key .
User’s password on the remote SSH server (when you select Password for Authentication Method).
The public key that the Remote SSH server uses to authorize your device and establish the tunnel connection (when you select Public Key for
Authentication Method).
The private key provided by the remote SSH server
(when you select Private Key for Authentication
Method).
SSH Security
Configure the SSH security settings (like ciphers and HMAC). Click Show to the right under Security Settings . Must select SSL/TLS under Protocol .
Field
Use default cipher suite
Ciphers
HMAC
Description
Enables use of the default cipher (check by default). No other user input is required.
Check which Cipher you want to use: AES128-CTR or
AES256-CTR (Use default cipher suite must be unchecked).
Check which hash-based message authentication code, you want to use: SHA1, SHA2-256,and/or SHA2-512
(Use default cipher suite must be unchecked).
ICMP
Internet Control Message Protocol (ICMP) is used by devices to send error messages such as that a requested service is not available or a host or device could not be reached. ICMP can also relay query messages.
Field
Enabled
Respond to LAN/Via Ethernet
Description
Enables ICMP responses.
If checked, the device will respond to ICMP traffic from the LAN, such as ping requests.
mPower TM Edge Intelligence Conduit AEP Software Guide 95
ADMINISTRATION
Field
Respond to WAN/Via Cellular
Description
If checked, the device will respond to ICMP traffic from the WAN, such as ping requests. This increases susceptibility to malicious activity.
SNMP
The device offers Simple Network Management Protocol (SNMP) which is used for collecting information from, and configuring network devices on an IP network. For more details, refer to Configuring SNMP .
Field
Via LAN
Via WAN
Description
Allows SNMP connections via LAN
Allows SNMP connections via WAN.
Modbus Slave
The Modbus feature allows the user to enable the Modbus query server. You can query this server over Modbus-
TCP for status information.
Field
Enabled (under Modbus Slave )
Via LAN
Port
Description
Enables the Modbus Query Server.
If checked, the device can query the Modbus server via
LAN.
Port number configured for Modbus.
For Modbus query information, refer to the MTR Modbus Information page on our Developer Resources website
(on .net) for details: http://www.multitech.net/developer/software/mtr-software/mtr-modbus-information/
IP Defense
A set of rules that decreases susceptibility to malicious activity. If these settings are configured too strictly, they may interfere with non-malicious activity.
Go to Administration > Access Configuration > IP Defense to find these features.
DoS Prevention
This area of the Access Configuration window engages a set of rules at the firewall that prevents Denial-of-Service attacks by limiting the amount of new connection requests to the device.
Field Description
Enabled
Per Minute
Enables DoS prevention (enabled by default).
Allowed number of new connections per minute until burst points are consumed. For example, if 60 new connections are received in a minute, decrement one burst point. If no more burst points, drop the packet.
96 mPower TM Edge Intelligence Conduit AEP Software Guide
ADMINISTRATION
Field
Burst
Description
Number of allowed burst for traffic spikes. A burst occurs when the Per Minute limit is reached. On a period where the Per Minute limit is not reached, one burst point is regained, up to the maximum.
Ping Limit
This area of the Access Configuration window engages a set of rules at the firewall that aims to prevent ping flood attacks by limiting the number of ICMP requests to the device. These rules that mitigate the effects of a ping DoS on your device do not apply if ICMP is disabled.
Field Description
Enabled Enables the Ping Limit feature (enabled by default).
Per Second
Burst
Allowed number of pings per second before burst points are consumed. Once burst points run out, ICMP packets will be dropped.
Number of burst points. On a period where the Per
Second limit is not reached, one burst point is regained, up to this maximum.
Brute Force Protection
This feature tracks login attempts at the RESTFUL API level. Its purpose is to prevent Dictionary attacks that attempt to brute force the user's password.
Field Description
Enabled
Attempts
Enables the Brute Force Prevention feature (enabled by default).
The number of failed attempts allowed before the user's account is locked out.
Lockout Minutes The number of minutes an account is locked out before a new login attempt will be accepted.
Bootloader Protection
To see or set these features, go to Administration > Access Configuration > Bootloader Protection and click Show.
Bootloader Password
This feature enables password authentication to access the device bootloader. It is disabled by default.
Field
Enable
Password
Confirm
Description
Enables the Bootloader Password feature to the right of
Authentication Status (enabled by default).
Enter password to access the device bootloader.
Enter the password again to confirm.
Debug Console mPower TM Edge Intelligence Conduit AEP Software Guide 97
