FibeAir IP-20C/S/E
User Guide
Ceragon Proprietary and Confidential
Page 396 of 597
You must use the same master key on both sides of the link. This means that if
you generate a master key automatically on one side of the link, you must copy
that key and for use on the other side of the link. Once payload encryption has
been enabled on both sides of the link, the Key Exchange Protocol periodically
verifies that both ends of the link have the same master key. If a mismatch is
detected, an alarm is raised and traffic transmission is stopped for the
mismatched carrier at both sides of the link. The link becomes non-valid and
traffic stops being forwarded.
To define the master key manually, enter the following command in Traffic
Encryption view:
Traffic Encryption [2/x]> payload encryption mkey
When you press <Enter>, the following prompt appears:
Please enter key:
Enter the master key and press <Enter>. The master key must be between 8
and 32 ASCII characters. The characters do not appear as you type them. To
display the master key and verify that you typed it correctly, enter the
payload
encryption status show
command described above. You can copy the master
key from the output of this command.
To generate the master key automatically, enter the following command in
Traffic Encryption view:
Traffic Encryption [2/x]> master key generate
A random master key is generated. You must copy and paste this key to the
remote end of the link to ensure that both sides of the link have the same
master key. To display and copy the master key, enter the
traffic
encryption status show
command described above. You can copy the master
key from the output of this command.
You can set all master keys defined on the unit to zero value. To zeroize the
master keys, enter the following command in root view:
root> payload encryption key zeroize
Warning!
Executing this command formats the unit’s disk, and
renders the unit non-operational. If it is necessary to use
this command, contact Ceragon Technical Support for
instructions how to re-configure the unit.
The session key is automatically regenerated at defined intervals. To set the
session key regeneration interval, enter the following command in Traffic
Encryption view:
Traffic Encryption [x/x]> payload encryption session-key period
set <00:00-00:00>
Enter the regeneration interval in hours and minutes (HH:MM). For example,
the following command configures radio interface 1 to regenerate the session
key every 4 hours and 15 minutes:
Traffic Encryption [2/1]> payload encryption session-key period
set 04:15
