Chapter 5: PTP 820S Management
System Security Features
Defenses in Management Communication Channels
Since network equipment can be managed from any location, it is necessary to protect the
communication channels’ contents end to end.
These defenses are based on existing and proven cryptographic techniques and libraries, thus
providing standard secure means to manage the network, with minimal impact on usability.
They provide defense at any point (including public networks and radio aggregation networks) of
communications.
While these features are implemented in Cambium Networks PTP 820 equipment, it is the
responsibility of the operator to have the proper capabilities in any external devices used to
manage the network.
In addition, inside Cambium Networks networking equipment it is possible to control physical
channels used for management. This can greatly help deal with all sorts of DoS attacks.
Operators can use secure channels instead or in addition to the existing management channels:
•
SNMPv3 for all SNMP-based protocols for both NEs and NMS
•
HTTPS for access to the NE’s web server
•
SSH-2 for all CLI access SFTP for all software and configuration download between NMS and
NEs
All protocols run with secure settings using strong encryption techniques. Unencrypted modes are
not allowed, and algorithms used must meet modern and client standards.
Users are allowed to disable all insecure channels.
In the network elements, the bandwidth of physical channels transporting management
communications is limited to the appropriate magnitude, in particular, channels carrying
management frames to the CPU.
Attack types addressed
•
Tempering with management flows
•
Management traffic analysis
•
Unauthorized software installation
•
Attacks on protocols (by providing secrecy and integrity to messages)
•
Traffic interfaces eavesdropping (by making it harder to change configuration)
•
DoS through flooding
26
Support for SNMPv3 is planned for future release.
Page 5-17