Chapter 3: System planning
Security planning
Page 3-39
From the factory default state, configure passwords for both the
root
and
admin
account at the
ADMINISTRATOR permission level, using the Account > Change Users Password page. (If
configure only one of these, then the other will still require no password for access into it and thus
remain a security risk.) If you are intent on configuring only one of them, delete the
admin
account.
The
root
account is the only account that CNUT uses to update the module.
After a password has been set for any ADMINISTRATOR-level account, initial access to the module
GUI opens the view of GUEST level.
Planning for RADIUS operation
Configure RADIUS where remote authentication is required for users of the web-based interface.
Remote authentication has the following advantages:
Control of passwords can be centralized.
Management of user accounts can be more sophisticated. For example; users can be prompted
by a network manager to change passwords at regular intervals. As another example,
passwords can be checked for inclusion of dictionary words and phrases.
Passwords can be updated without reconfiguring multiple network elements.
User accounts can be disabled without reconfiguring multiple network elements.
Remote authentication has one significant disadvantage in a wireless link product such as 450
Platform Family. If the wireless link is down, a unit on the remote side of the broken link may be
prevented from contacting a RADIUS Server, with the result that users are unable to access the
web-based interface.
One useful strategy would be to combine RADIUS authentication for normal operation with a
single locally-authenticated user account for emergency use.
PMP 450 Platform Family SM provides a choice of the following authentication methods:
EAP-MSCHAPv2
EAP-TTLS
Ensure that the authentication method selected in 450 Platform Family is supported by the RADIUS
server.
Filtering protocols and ports
Configure filters for specified protocols and ports from leaving the AP/BHM and SM/BHS and
entering the network. This protects the network from both intended and inadvertent packet loading
or probing by network users. By keeping the specified protocols or ports off the network, this
feature also provides a level of protection to users from each other.
Protocol and port filtering is set per AP/SM/BH. Except for filtering of SNMP ports, filtering occurs
as packets leave the AP/SM/BH.
For example, if SM is configured to filter SNMP, then SNMP packets are blocked from entering the
SM and, thereby, from interacting with the SNMP portion of the protocol stack on the SM.
Summary of Contents for PMP 450 Series
Page 125: ...Chapter 3 System planning Typical deployment Page 3 3 Figure 37 Wall installation...
Page 126: ...Chapter 3 System planning Typical deployment Page 3 4 Figure 38 Roof installation...
Page 127: ...Chapter 3 System planning Typical deployment Page 3 5 Figure 39 GPS receiver wall installation...
