Chapter 1: Product description
System management
Page 1-51
Transport layer security
The HTTPS/TLS interface provides the same set of web-pages as the HTTP interface, but allows
HTTP traffic to be encrypted using Transport Layer Security (TLS). PTP 670 uses AES
encryption for HTTPS/TLS. Operation of HTTPS/TLS is enabled by purchase of an optional AES
upgrade.
HTTPS/TLS requires installation of a private key and a public key certificate where the common
name of the subject in the public key certificate is the IP address or host name of the PTP 670
unit. PTP 670 supports certificates with 2048-bit key size.
HTTPS/TLS operation is configured through the web-based interfaces using the Security
Wizard.
Note
The PTP 670 has no default public key certificate, and Cambium Networks is not able
to generate private keys or public key certificates for specific network applications.
Note
PTP 670 supports a single public key certificate for HTTPS. This certificate must be
based on an IPv4 or IPv6 address as the Common Name. Any attempt to use HTTPS
without a certificate for the associated IP address will not be secure, and will trigger
browser security warnings. It follows from this that the Dual IPv4/IPv6 interface should
not normally be used when HTTPS is required.
User account management
PTP 670 allows a network operator to configure a policy for login attempts, the period of
validity of passwords and the action taken on expiry of passwords.
Identity-based user accounts
The PTP 670 web-based interface provides two methods of authenticating users:
•
Role-based user authentication allows the user, on entry of a valid password, to access all
configuration capabilities and controls. This is the default method.
•
Identity-based user authentication supports up to 10 users with individual usernames and
passwords.
When identity-based user accounts are enabled, a security officer can define from one to ten
user accounts, each of which may have one of the three possible roles:
•
Security officer.
•
System administrator.
•
Read only.
Identity-based user accounts are enabled in the Local User Accounts page of the web-based
interface.
