Cambium Networks PMP 450, Руководство по планированию

Страница: 146 / 223

PMP 450 Planning Guide
Planning for airlink security
Cambium fixed wireless broadband IP systems employ the following form of encryption for security of the wireless
link:
•
DES (Data Encryption Standard) : An over-the-air link encryption option that uses secret 56-bit keys and 8
parity bits. DES performs a series of bit permutations, substitutions, and recombination operations on blocks of
data. DES encryption does not affect the performance or throughput of the system.
•
AES (Advanced Encryption Standard): An over-the-air link encryption option that uses the Rijndael
algorithm and 128-bit keys to establish a higher level of security than DES. AES products are certified as
compliant with the Federal Information Processing Standards (FIPS 197) in the U.S.A.
Planning for RF Telnet Access Control
The RF Telnet Access feature restricts Telnet access to the AP from a device situated below a network SM
(downstream from the AP). This is a security enhancement to restrict RF-interface sourced AP access specifically
to the LAN1 IP address and LAN2 IP address (Radio Private Address, typically 192.168.101.[LUID]). This
restriction disallows unauthorized users from running Telnet commands on the AP that can change AP
configuration or modifying network-critical components such as routing and ARP tables.
Forwarding Downlink PPPoE PADI packets
The AP supports the control of forwarding of PPPoE PADI (PPPoE Active Discovery Initiation) packets. This
forwarding is configured on the AP GUI Configuration , Radio tab by parameter PPPoE PADI Downlink
Forwarding . When set to “Enabled”, the AP allows downstream and upstream transmission of PPPoE PADI
packets. When set to “Disabled”, the AP will NOT allow PPPoE PADI packets to be sent out of the AP RF
interface (downstream) but will allow PPPoE PADI packets to enter the RF interface (upstream) and exit the
Ethernet interface.
Planning for RADIUS integration
PMP 450 modules include support for the RADIUS (Remote Authentication Dial In User Service) protocol
supporting Authentication, Authorization, and Accounting (AAA).
RADIUS Functions
RADIUS protocol support provides the following functions:
•
SM Authentication allows only known SMs onto the network (blocking “rogue” SMs), and can be
configured to ensure SMs are connecting to a known network (preventing SMs from connecting to “rogue”
APs). RADIUS authentication is used for SMs, but is not used for APs. Cambium modules support EAP-
TTLS and EAP-MSCHAPv2 authentication methods.
1-136
pmp-0047 (March 2014)