Configuring Admin Login Restrictions

Overview

The Login Restrictions page helps you secure admin access to the Cato Management Application (CMA). You can control authentication methods, restrict access by IP address, and manage password expiration and administrator sessions. These settings help reduce the risk of unauthorized access and limit exposure from unattended sessions.

Understanding Admin Login Restriction Configurations

The Admin Login restrictions are managed from the Account > Login Restrictions page

Login Authentication Method for Cato Management Application

Use the Login Authentication Method for Cato Management Application section to select how administrators authenticate to the CMA. If you have configured an SSO provider, you can allow single sign-on (SSO), user credentials, or both, according to your organization’s authentication requirements.

To manage admin login authentication methods for the CMA:

1. From the navigation menu, select  Account > Login Restrictions.

2. Select your required authentication menthod(s).

3. Click Save.

Setting Login Restrictions for Admins

You can require all administrators to only log from specific IP addresses.

For accounts that use egress IP addresses (NATed IPs), you can allow admins to log in from these IP addresses. If you enable the checkbox to ​Also allow logins from the NATed IPs​​, you must specify the IPs in the ​Allowed Login IPs​​ area. Otherwise, the admins will be access the CMA from any IP.

To configure admin login restrictions:

1. From the navigation menu, select Account > Login Restrictions.

2. To only allow admins to log in to the CMA from specific IP addresses:

   1. In the Login Restrictions for Cato Management Application section, in Allowed Login IPs, enter the IP address to allow.

   2. Click the add icon.

      The IP address is added to the Allowed Login IPs list.

   3. To remove an allowed IP address, select the IP address and then click the delete icon.

3. (Optional) To allow admins to log in from a translated IP, select Also allow logins from the NATed IPs.

4. Click Save.

Setting a Password Expiration

Use Password Expiration to define how long administrator passwords remain valid. Requiring periodic password changes helps you align administrator access with your organization’s password policy. Minimum expiration time is 14 days.Maximum expiration time is 730 days.

To set a password expiration:

1. From the navigation menu, select Account > Login Restrictions.

2. Configure the password expiry time (in days).

3. Click Save.

Configuring the Maximum Concurrent Sessions

Use Maximum Concurrent Sessions per Admin to limit the number of sessions each administrator can have open at the same time. Once an administrator reaches the limit, the CMA denies additional sign-in attempts until an existing session is signed out or expires.

By default, the number of concurrent sessions is unlimited. Leave this field empty to retain unlimited sessions.

To configure the maximum concurrent sessions:

1. From the navigation menu, select Account > Login Restrictions.

2. Set the number of allowed concurrent sessions.

3. Click Save.