Axis P9117-PV User Manual page 34

AXIS P9117–PV Corner Camera
The web interface
Authentication method: Select an EAP type used for authentication. The default option is EAP-TLS. EAP-PEAP/MSCHAPv2 is a
more secure option.
Client certificate: Select a client certificate to use IEEE 802.1x. The authentication server uses the certificate to validate the
client's identity.
CA certificate: Select CA certificates to validate the authentication server's identity. When no certificate is selected, the device
tries to authenticate itself regardless of what network it is connected to.
EAP identity: Enter the user identity associated with the client certificate.
EAPOL version: Select the EAPOL version that is used in the network switch.
Use IEEE 802.1x: Select to use the IEEE 802.1x protocol.
IEEE 802.1AE MACsec
IEEE 802.1AE MACsec is an IEEE standard for media access control (MAC) security that defines connectionless data confidentiality
and integrity for media access independent protocols.
The settings are only available if you use EAP-TLS as the authentication method:
Mode
• Dynamic CAK / EAP-TLS: The default option. After a secured connection, the device checks for MACsec on the network.
• Static CAK / pre-shared key (PSK): Select to set the key name and value to connect to the network.
The settings are only available if you use EAP-PEAP/MSCHAPv2 as the authentication method:
• Password: Enter the password for your user identity.
• Peap version: Select the Peap version that is used in the network switch.
• Label: Select 1 to use client EAP encryption; select 2 to use client PEAP encryption. Select the Label that the network
switch uses when using Peap version 1.
Prevent brute-force attacks
Blocking: Turn on to block brute-force attacks. A brute-force attack uses trial-and-error to guess login info or encryption keys.
Blocking period: Enter the number of seconds to block a brute-force attack.
Blocking conditions: Enter the number of authentication failures allowed per second before the block starts. You can set the
number of failures allowed both on page level and device level.
Firewall
Activate: Use the toggle to turn on the firewall.
Default Policy: Choose to Allow or Deny a default state for the firewall.
Address: Enter the IP numbers that are allowed or denied access to the device. You can use IPv4/IPv6 or CIDR format
Protocol: Choose which protocol to add to the rule.
Port: Enter a port number between 1 and 65535.
Policy: Choose to Allow or Deny this rule.
Pending rules: An overview of the rules that you are yet to confirm.
Confirm rules: Click to activate a selected rule.
Active rules: An overview of the rules you are currently running on the device.
Custom signed firmware certificate
34