Chapter 3: System planning
Security planning
Page 3-36
Security planning
This section describes how to plan for 450 Platform Family links to operate in secure mode.
Managing module access by passwords
Filtering protocols and ports
Port Configuration
Isolating AP/BHM from the Internet
Ensure that the IP addresses of the AP/BHM in the network:
are not routable over the Internet.
do not share the subnet of the IP address of your user.
RFC 1918, Address Allocation for Private Subnets, reserves for private IP networks three blocks of
IP addresses that are not routable over the Internet:
/8 subnets have one reserved network, 10.0.0.0 to 10.255.255.255.
/16 subnets have 16 reserved networks, 172.16.0.0 to 172.31.255.255.
/24 subnets have 256 reserved networks, 192.168.0.0 to 192.168.255.255.
Encrypting radio transmissions
Cambium fixed wireless broadband IP systems employ the following form of encryption for
security of the wireless link:
DES (Data Encryption Standard): An over-the-air link encryption option that uses secret 56-bit
keys and 8 parity bits. DES performs a series of bit permutations, substitutions, and
recombination operations on blocks of data. DES encryption does not affect the performance
or throughput of the system.
AES (Advanced Encryption Standard): An over-the-air link encryption option that uses the
Rijndael algorithm and 128-bit keys to establish a higher level of security than DES. AES
products are certified as compliant with the Federal Information Processing Standards (FIPS
197) in the U.S.A.
The default encryption setting for 450 Platform Family ODU is "None".
