Compact specification handoff

CPE Router Authentication Security

Cpe router authentication security belongs in the same handoff as the radio row. A login method, a firmware path, and a management VLAN change which factories can answer without a deviation.

Bench setup with a CPE console cable, credential card, and firmware checklist
  1. Name the management plane: local web, SSH, SNMP, or controller join.
  2. State the account model: local users, RADIUS, or a still-open choice.
  3. Ask which firmware branch the quote assumes.

Lifecycle matrix for the security handoff

StageBuyer writesFactory confirms
Quote Required login methods and any protocol that must be disabled. Whether that build exists on the quoted revision.
Sample or first article Who may hold the default credential during incoming inspection. How the default account is rotated and documented.
Acceptance The management VLAN, the time source, and the log destination. Limits of the logging feature on that model.
Later software Whether security updates are included or a separate license. The support window tied to the exact model, not the family.

Open choices that should stay visible

Local accounts are simpler on a single mast radio and weaker if the password never rotates. RADIUS adds a server dependency and a failure mode when the management path itself is the wireless bridge. Write which failure the site can accept.

An OEM-coded management image and a compatible build are not interchangeable. The compatible path may boot, yet the security advisory list and the license file can differ. Ask the factory to name the software identity string it will ship.

Measurement accuracy is the wrong word for a login feature, but the test still needs a method. A useful check is whether SSH on a stated port answers after factory reset, and whether the web console can be turned off. Record pass or fail against the quoted revision. Calibration traceability applies if you also buy a meter to verify transmit power. It does not certify the login page.

Procurement scenario: a shared yard with two maintenance crews

Background: two contractors will touch the same outdoor CPE, and the buyer does not want a shared printed password on the mast. Process: the handoff requires unique local accounts, SSH, a disabled default web admin where the model allows it, and a note that RADIUS is preferred but not yet available. Result: each factory must say if that combination is a standard build or a deviation, and the quotation cannot hide a controller license inside the radio price. This scenario is a specification drill, not a customer reference.

Ingress protection and connector mating cycle still sit beside the security rows because a swapped antenna or a reseated gland is a physical change, not a software one. Frequency range and gain stay on the radio row so an alternative focused on login settings cannot quietly change the RF path.

Runtime of a small backup battery, if the site asks for one, is a separate line with the load assumed. A 12 V, 7 Ah pack feeding a 6 W radio is a different offer from a unit powered by PoE with no battery. Do not fold that pack into the authentication price.

Keep the radio numbers beside the login row: frequency range, 2x2 or 3x3 MIMO, channel width of 20 MHz, 40 MHz, or 80 MHz, antenna gain in dBi, VSWR, and 50 ohm impedance. Switching capacity matters when the CPE also bridges a small indoor switch. Forwarding rate can be marked not applicable for a single bridge.

Use the 4G site questions when the SIM policy is part of the same handoff, and the product cards to pick the family name that should appear on the form.

Delivery questions that affect the security scope

When is the credential handed over?

Decide whether it travels with the packing list, a separate channel, or after incoming inspection. The quote should say which of those the factory included.

Does configuration labor sit in the unit price?

If someone must load accounts before shipment, that labor, the destination, and the timing belong on their own lines. A bare radio price is a different offer.

What evidence arrives with the crate?

Ask for the firmware identity, the datasheet revision, and any FCC equipment authorization reference that matches the shipped model. A generic security brochure is not that file.

Send the security handoff

Put login method, firmware questions, quantity, destination, and timing in one requirement. Optional budget and supplier preference stay helper fields, not a score of the factory.