CLI modes and account privileges

CLI Guide | Forcepoint Appliances | v8.4.x

By default, only the admin account is enabled on each appliance. This is the account password that you set during the firstboot process.

Three working modes (sometimes called contexts) are supported by the Command Line Interface (CLI) and are available to every person logged on as admin.


Mode Name	Description
view	The default mode. Used for displaying status and settings.
config	The mode required for changing settings and enabling/disabling options.
diagnose	The mode used to perform troubleshooting. It provides support for system and network test commands.

Immediately after logon, an admin is always in the view mode.

To move from view to the config mode, enter config on the command line. The admin password is required for this mode switch.

To move from view to the diagnose mode, enter diagnose on the command line.

To return to the view mode from config or diagnose, enter exit on the command line.

You cannot move from config directly to diagnose or vice versa.


	Tip In order to toggle more easily between diagnose and config modes, an admin may choose to open two sessions (diagnose mode and config mode) at the same time.

Only one person logged in as admin can work in config mode at a time.

If needed, a person logged in as admin who is working in the view mode can use the following command to immediately bump the admin who is working in the config mode:

clear session --config

This moves the administrator who had been working in config mode back into the view mode.

A person logged in as admin has full privileges in the view, config, and diagnose modes. While working in the config mode, an admin can optionally enable two accounts:

The audit account is for colleagues who need to view settings. This account can work only in the view mode and can use only show and exit commands.

The tech-support account is for use by Forcepoint technicians to provide technical support.