Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is Management Access; with which settings does TR7 protect management access?
Short answer
Management Access is the screen that controls the management access of the TR7 device: which IP addresses and ports are used for access to the web interface (HTTP, HTTPS) and over SSH, FTP and SNMP, and to which networks access is limited in each protocol, are defined here; the default port of a new row is 80 for HTTP, 443 for HTTPS, 22 for SSH, 21 for FTP and 161 for SNMP. The same screen contains the login security (HTTP(s) CAPTCHA Login Protection, Two-factor Authentication (2FA), Brute-force Protection), the HTTPS certificate and the lowest and highest TLS version to be accepted, and the Prometheus and System Users settings. The settings are changed in the Edit form; the form is not saved unless at least one HTTP or HTTPS access address is defined.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Settings → Device Management → Management Access → Edit | HTTP, HTTPS, SSH, FTP, SNMP: IP and port rows | The management address and port that each protocol listens on |
| The same form, under each protocol | HTTP Allowed Networks (in the same way for the other protocols) | Limiting access to the networks given as CIDR; while it is off, No restriction |
| The same form, HTTPS section | HTTPS Certificate, Min. TLS Version / Max. TLS Version | The certificate of the management interface and the accepted TLS version range |
| The same form | HTTP(s) CAPTCHA Login Protection, Two-factor Authentication (2FA) | CAPTCHA and a second factor on the login screen |
| The same form, Brute-force Protection section | HTTP(s) TR7 Idle Session Time, Failed Login Expire Time, Max. Failed Login per IP, Max. Failed Login per IP & Username | The idle session time, and keeping an IP or user that exceeds the failed login limit waiting |
| The same form | Prometheus, System Users | The networks allowed to access Prometheus; the system accounts of the device (the FTP accounts and the admin, network and setup users) and their passwords |
The SNMP agent and Prometheus concepts are explained on separate pages: What is the difference between SNMP Trap and the SNMP agent? · What is Prometheus; how are TR7 metrics exposed to Prometheus?
Common Misconceptions
- "The management interface must be accessible from every network." With the allowed networks field of each protocol, access is narrowed to the management networks only; while the field is off, no network-based restriction is applied.
- "Management Access is only a port setting." The login security (CAPTCHA, 2FA, brute-force protection), the HTTPS certificate and the TLS version range are also in the same form.
- "Web access can be closed completely from this screen." The form is not saved unless at least one HTTP or HTTPS access address is defined ("At least 1 HTTP(s) access address must be given").
How it is done in the documentation
