Wireless Security and Authentication in cnWave 60 GHz

cnWave offers feature where node should authenticate themselves during the Ignition procedure.
By default link authentication is disabled.

There are two secure authentication available to cnWave node.

Authentication mode can be configured from Network level which is applicable to entire sector.
image

WPA-PSK:
Currently the PSK key is pre-configured. In future there would be option to configure this key on network level.
WPA2 protocol is currently supported.
For encryption, AES-GCMP-128 bit is supported.

Note: Release 1.0.1 support configuring PSK

802.1X
802.1x authentication on a sector from a POP node. This is a network level configuration and is common to entire sector.

image

RADIUS Server IP: IPv6 address of RADIUS server. In future release we will support IPv4 address as well.

RADIUS server port: UDP Port number where server is running , default is 1812.

RADIUS Server shared secret: shared secret.

For RADIUS authentication cnWave support EAP-TLS only where each node should have client certificate and private key. In addition , node should also have CA certificate to verify the RADIUS server. These files can be uploaded from the device GUI of each node.

Configuration to be done on Controller GUI for each node
image

Configuration to be done on Node GUI
image

Note : It is important for both the configuration to be done for a successful authentication.

RADIUS Server Configuration:

Any radius server can be used for authentication. The following configuration to be done.

  • Make sure RADIUS packets from IPv6 subnet i.e. lo IP subnet is accepted in radius configuration.
  • Configure EAP-TLS for radius server and set up server certificate, key. Note that server certificate is signed by CA uploaded in node configuration.
  • Set the the CA certificate which signed the client certificate installed on each node.
    .
2 Likes

hi, is it possible to configure a psk or 802.1X key without having a radius server?

PSK does not require radius server.

When will cnWave will support TACACS+?

Thank you!

Dave