Filter
Top Products
13-13
Cisco Broadband Access Center 3.8 Administrator Guide
OL-27172-01
Chapter 13 Configuring CWMP Service Security
Configuring Security for DPE Services
dpe# dpe reload
Process dpe has been restarted.
% OK
Note For detailed information, see the Cisco Broadband Access Center 3.8 DPE CLI Reference.
Configuring CPE Authentication
CPE authentication is supported through:
• Shared secret by using HTTP Basic or Digest authentication.
• Client certificates by using SSL. You can use certificate-based client authentication in lieu of or in
addition to shared secret HTTP-based authentication.
• External client certificate authentication. In this scenario, the SSL connection is terminated at the
hardware load balancer, which also authenticates the client.
The objective of authentication is to establish a trusted device ID, which is used to look up device
instructions in the DPE cache. This device ID correlates to the device identifier preprovisioned for the
device record at the Cisco BAC RDU database. In case of shared secret HTTP-based authentication, the
username serves to establish the identity of the device and is treated as a device ID.
In case of authentication using unique client certificates, the device ID is obtained from the device
certificate's CN field. With client certificate authentication by an external entity (such as a Cisco ACE
4710 load balancer), the certificate data, including the CN field, is passed to the DPE in the HTTP
headers.
You can also choose the option of having no client authentication if clients are trusted. For example, the
clients can already be authenticated for network access based on the subscriber physical line. In this case,
you can configure Cisco BAC with no-authentication and it will derive the trusted device ID from the
Inform message.
You can configure CPE authentication options from the DPE CLI.
Shared Secret Authentication
Cisco BAC supports HTTP authentication based on a shared password between the CPE and the DPE.
This authentication is available in two modes: Basic and Digest.
Note To limit security risks during client authentication, Cisco recommends using the Digest mode (the
default configuration). You should not allow client authentication in the Basic mode.