Chapter 1: Product description
System management
Page 1-55
Access to critical security parameters
The SNMPv3 management interface does not provide access to critical security parameters
(CSPs) of PTP 670. It is not possible to read or modify AES keys used to encrypt data
transmitted at the wireless interface. Neither is it possible to read or modify security
parameters associated with TLS protection of the web-based management interface. The
recovery mode option to zeroize CSPs does not affect SNMPv3 configuration.
MIB-based management of SNMPv3 security
PTP 670 supports a standards-based approach to configuring SNMPv3 users and views
through the SNMP MIB. This approach provides maximum flexibility in terms of defining views
and security levels appropriate for different types of user.
PTP 670 provides a default SNMPv3 configuration. This initial configuration is not secure, but it
provides the means by which a secure configuration can be created using SNMPv3.
The secure configuration should be configured in a controlled environment to prevent
disclosure of the initial security keys necessarily sent as plaintext, or sent as encrypted data
using a predictable key. The initial security information should not be configured over an
insecure network.
The default configuration is restored when any of the following occurs:
•
All ODU configuration data is erased.
•
All SNMP users are deleted using the SNMP management interface.
•
The SNMP Engine ID Format has been changed.
•
The SNMP Engine ID Format is Internet Address AND the Internet Address has been
changed.
•
The SNMP Engine ID Format is Text String AND the text string has been changed.
•
The SNMP Engine ID Format is MAC Address AND configuration has been restored using a
file saved from a different unit.
•
SNMPv3 Security Management is changed from web-based to MIB-based.
The default user configuration is specified in
SNMPv3 default configuration (MIB-based)
page
PTP 670 creates the
initial
user and template users with localized authentication and privacy
keys derived from the passphrase string
123456789
. Authentication keys for the templates
users are fixed and cannot be changed. Any or all of the template users can be deleted.
The default user
initial
is created with a view of the entire MIB, requiring authentication for
SET operations. There is no access for template users.
Note
VACM grants access for requests sent with more than the configured security level.
