VX640 Router Manual, Rev. D
37
August, 2013
Administration Access
There are only two methods by which the administrator can access the VX Router Controller
Configurations:
1. Using the serial console directly connected to the VX Router. (It should be noted that while
no administrator password is required to use the serial console, physical access to the router is
required, therefore the router should be stored in a physically secure location to avoid
unauthorized access.)
2. Using SSH access
The router allows SSH connections to the router for management purposes. SSH sessions are
authenticated using an encrypted password file.
3. Password Security
For security purposes, the router defaults to using the Message-Digest Algorithm (MD5) and
shadow passwords. It is highly recommended that you do not alter these settings. If you
select the older Data Encryption Standard (DES) format, passwords will be limited to eight
alphanumeric characters (disallowing punctuation and other special characters) with a modest
56-bit level of encryption. The single most important thing you can do to protect the router is
create a strong password.
4. Creating Strong Passwords:
The password can contain up to 127 characters and cannot contain a space.
MAKE THE PASSWORD AT LEAST EIGHT CHARACTERS LONG. The longer the password,
the more effective it will be. If you are using an MD5 password, it should be approximately 15
characters long. With DES passwords, use the maximum eight character length.
MIX UPPER AND LOWER CASE LETTERS. Passwords are case sensitive, so mixing will
multiply the number of possible combinations.
MIX LETTERS AND NUMBERS. Intersperse numbers within the password to enhance its
strength.
INCLUDE NON-ALPHANUMERIC CHARACTERS. Special characters (& $ % >) and punctuation
marks (? “- !) increase the strength of a password.
Secure Application Examples
The Diagram on page 39 shows the VX640 Matrix Router in a secure application. The highly secure
components are described as the Red Network and the other, lower security components are
described as the Black Network. The Red Network, containing the computers (sources), is shown in a
physically secure environment along with the VX Router, the computer server used to manage the
Router, and the Network Hub. The Network Hub is a dedicated network used only to connect the VX
Router to the computer server. This dedicated network does not connect to any other components and
does not extend beyond the physically secure environment. The dedicated network connection may be
replaced by a direct serial connection (RS-232) between the VX Router and the computer server.
Note: The VX Router and the computer server used to manage the Router must be protected
according to the highest security classification of any component in the entire network
application.
Note: The optical connections and DESTINATION receiver designated as Red Network
must be physically secure.
