2-30
Cisco uBR7200 Series Universal Broadband Router Software Configuration Guide
OL-2239-03
Chapter 2 Configuring the Cable Modem Termination System for the First Time
Reviewing Your Settings and Configurations
Note
The cable interface must also support encryption and decryption.
When Baseline Privacy is enabled, the Cisco uBR7200 series router routes encrypted and decrypted
packets from a host or peer to another host or peer. BPI is configured with key encryption keys (KEKs)
and traffic encryption keys (TEKs). A KEK is assigned to a CM, based on the CM’s service identifier
(SID), and permits the CM to connect to the Cisco uBR7200 series router when Baseline Privacy is
activated. The TEK is assigned to a CM when its KEK has been established. The TEK is used to encrypt
data traffic between the CM and the Cisco uBR7200 series router.
KEKS and TEKs can be set for Baseline Privacy on the HFC network to expire based on a
grace-time
or a
life-time
value, defined in seconds. A
grace-time
value assigns a temporary key to a CM to access the
network. A
life-time
value assigns a more permanent key to a CM. Each CM that has a
life-time
value
assigned requests a new lifetime key from the Cisco uBR7200 series router before the current one expires.
To set the duration in
seconds
for KEK or TEK
grace-time
or
life-time
, use the following commands
in global configuration mode. To restore the default values, use the
no
form of each command.
cable privacy kek
{
grace-time
[
seconds
] |
life-time
[
seconds
]}
no cable privacy kek
{
grace-time
|
life-time
}
cable privacy tek
{
grace-time
[
seconds
] |
life-time
[
seconds
]}
no cable privacy tek
{
grace-time
|
life-time
}
Syntax Description
Tip
Use the
show cable modem
command to identify a CM with encryption and decryption enabled. The
online(pk)
output of this command reveals a CM that is registered with BPI enabled and a KEK assigned.
The
online(pt)
output reveals a CM that is registered with BPI enabled and a TEK assigned.
Should you want to change the Cisco uBR7200 series default of 56-bit encryption and decryption to
40-bit, use the “40 bit DES” option:
Router(config-if)#
cable privacy
?
40-bit-des select 40 bit DES
^^^^^^^^^^
authenticate-modem turn on BPI modem authentication
authorize-multicast turn on BPI multicast authorization
kek KEK Key Parms
mandatory force privacy be mandatory
tek TEK Key Parms
Software then generates a 40-bit DES key, where the DES key that is generated and returned masks the
first 16 bits of the 56-bit key to zero in software. To return to 56-bit encryption and decryption after
changing to 40-bit, enter the
no
command in front of the “40 bit des” option.
grace-time
seconds
(Optional) Length of key encryption grace-time in seconds. Valid range is
300 to 1800 seconds. The default
grace-time
value is 600 seconds.
life-time
seconds
(Optional) Length of the key encryption life-time in seconds.Valid range is
86,400 to 604,8000. The default
life-time
value is 604800 seconds.
