User Guide for FibeAir® IP-20 All-Outdoor Products, CeraOS 10.5
Page 540 of 825
Ceragon Proprietary and Confidential
To configure payload encryption:
1 Verify that both the local and remote units are running with no alarms. If any
alarm is present, take corrective actions to clear the alarms before
proceeding.
2 If the link is using in-band management, identify which unit is local and which
unit is remote from the management point of view.
3 In a protected link, enable protection lockout, first on the remote and then on
the local unit. See
Disabling Automatic Switchover to the Standby Unit (CLI)
4 To configure AES on a radio carrier, you must first enter traffic encryption
view for the specific radio. To enter Payload Encryption view, enter the
following command in root view:
root> payload encryption slot 2 port <port>
For example, to configure AES on radio interface 1, enter the following command
in root view:
root> payload encryption slot 2 port 1
Payload Encryption [1/1]>
To display the payload encryption mode of the radio interface, enter the following
command in Payload Encryption view:
Payload Encryption [2/x]> payload encryption mode show
The following display indicates that payload encryption is enabled on radio
interface 1:
Payload Encryption [2/1]> payload encryption mode show
Admin Mode: AES-256
The following display indicates that payload encryption is disabled on radio
interface 1:
Payload Encryption [2/1]> payload encryption mode show
Admin Mode: Disable
5 Configure the master key on the remote unit by doing one of the following:
◦
Enter a master key manually.
◦
Generate the master key automatically.
You must use the same master key on both sides of the link. This means that if
you generate a master key automatically on one side of the link, you must copy
that key and for use on the other side of the link. Once payload encryption has
been enabled on both sides of the link, the Key Exchange Protocol periodically
