User Guide for FibeAir® IP-20 All-Outdoor Products, CeraOS 10.5
Page 242 of 825
Ceragon Proprietary and Confidential
You must use the same master key on both sides of the link. This means that if
you generate a master key automatically on one side of the link, you must copy
that key and for use on the other side of the link. Once payload encryption has
been enabled on both sides of the link, the Key Exchange Protocol periodically
verifies that both ends of the link have the same master key. If a mismatch is
detected, an alarm is raised and traffic transmission is stopped for the
mismatched carrier at both sides of the link. The link becomes non-valid and
traffic stops being forwarded.
When you enter a master key, or when the master key is automatically generated,
the key is hidden behind dots. To copy the master key, you must display the key.
To display the master key, click
Show Key
. A new
Master key
field appears,
displaying the master key. You can copy the key to the clipboard from this field.
Figure 176: Payload Encryption
–
Edit Page with Master Key Displayed
7 Record and save the master key generated in Step 6.
8 On the local unit, follow Steps 4 through 6 to configure the same master key
configured on the remote unit also on the local unit.
9 Enable payload encryption on the remote unit:
i
In the
Admin Mode
field, select
AES-256
to enable payload encryption.
ii In the
Session Key Period
field, configure a time interval in hours and
minutes (HH:MM). This is the interval at which the session key is
automatically regenerated.
Note:
The Session Key Period must be the same on both sides of the link.
iii When you are finished, click
Apply
.
This step will cause the link status to be Down until payload encryption is
successfully enabled on the local unit. However, the RSL measured on the
link should remain at an acceptable level.
