Black Box EncrypTight ET0010A User manual

BL A C K B OX®
The EncrypTight™Enforcement Point Installation
Guide provides detailed information on how to
install and configure EncrypTight Enforcement
Points.
EncrypT ightEnforcementPoint(ETEP)InstallationGuide
ET0010A
ET0100A
ET1000A
ET10000A
Order toll-free in the U.S.: Call 877-877-BBOX (outside U.S. call 724-746-5500)
FREE technical support 24 hours a day, 7 days a week: Call 724-746-5500 or fax [phone]
Mailing address: Black Box Corporation, 1000 Park Drive, Lawrence, PA 15055-1018
Web site: www.blackbox.com • E-mail: [e-mail]
Customer
Support
Information
EncrypTight Enforcement Point (ETEP) Installation Guide, Version 2.3.x

ETEP Installation Guide 3
Table of Contents
About This Document ...............................................................................................................7
Contacting Customer Support ...............................................................................................8
Product Overview .....................................................................................................................9
ETEP Introduction ................................................................................................................9
ET0005A Physical Description ............................................................................................10
ET0005A Indicators and Connectors ..............................................................................10
ET0010A Physical Description ............................................................................................12
ET0010A-402 Physical Description ...............................................................................12
Front Panel Connectors .............................................................................................12
Status Indicators ........................................................................................................12
Rear Panel .................................................................................................................13
ET0010A-602 Physical Description ...............................................................................14
Front Panel Connectors .............................................................................................14
Status Indicators ........................................................................................................14
Rear Panel .................................................................................................................15
ET0100A Physical Description ......................................................................................16
Front Panel Connectors .............................................................................................16
LED Indicators ..........................................................................................................17
Rear Panel .................................................................................................................17
ET0100A Physical Description ......................................................................................18
Front Panel Connectors .............................................................................................18
LED Indicators ..........................................................................................................19
Rear Panel .................................................................................................................20
ET1000A Physical Description ......................................................................................20
Front Panel Connectors .............................................................................................20
LED Indicators ..........................................................................................................21
Rear Panel .................................................................................................................22
ET1000A Physical Description ......................................................................................23
Front Panel Connectors .............................................................................................23
LED Indicators ..........................................................................................................24
Rear Panel .................................................................................................................25
ET10000A Physical Description ....................................................................................25
Front Panel Connectors .............................................................................................25
LED Indicators ..........................................................................................................26
Rear Panel .................................................................................................................27
Features ...........................................................................................................................28
Specifications ..................................................................................................................29
MIB Support ...................................................................................................................34

4ETEP Installation Guide
Installation .................................................................................................................................37
Safety Guidelines ............................................................................................................37
Software Requirements ...................................................................................................37
ETEP Site Preparation ....................................................................................................38
Firewall Ports...................................................................................................................39
Installing the ET0005A .........................................................................................................42
Cabling Requirements: ET0005A ...................................................................................42
Unpacking the Shipping Carton: ET0005A.....................................................................42
Installation Instructions: ET0005A .................................................................................43
Rack Mount Installation ............................................................................................43
Solid Surface Installation ..........................................................................................44
Connecting the Cables: ET0005A ..................................................................................44
Powering On the ET0005A .............................................................................................45
Installing the ET0010A .........................................................................................................45
Cabling Requirements: ET0010A ...................................................................................46
Unpacking the Shipping Carton: ET0010A ....................................................................46
Installation Instructions: ET0010A .................................................................................47
Rack Mount Installation ............................................................................................47
Solid Surface Installation ..........................................................................................50
Connecting the Cables: ET0010A ..................................................................................51
Powering On the ET0010A .............................................................................................52
Installing the ET0100A .........................................................................................................53
Cabling Requirements: ET0100A ...................................................................................53
Unpacking the Shipping Carton: ET0100A ....................................................................54
Rack-Mount Installation: ET0100A ...............................................................................54
Connecting the Cables: ET0100A ..................................................................................55
Powering on the ET0100A .............................................................................................56
Installing the ET0100A .........................................................................................................57
Cabling Requirements: ET0100A ...................................................................................58
Unpacking the Shipping Carton: ET0100A ....................................................................58
Rack Mount Installation: ET0100A ................................................................................58
Connecting the Cables: ET0100A ..................................................................................59
Powering on the ET0100A .............................................................................................59
Installing the ET1000A .........................................................................................................60
Cabling Requirements: ET1000A ...................................................................................61
Unpacking the Shipping Carton: ET1000A ....................................................................61
Rack Mount Installation: ET1000A ................................................................................62
Grounding of DC Power Supply: ET1000A .............................................................63
For DC Power Supply Only ......................................................................................63
For Earth Connection ................................................................................................63
Connecting the Cables: ET1000A ..................................................................................64
Powering on the ET1000A .............................................................................................65
Installing the ET1000A .........................................................................................................67
Cabling Requirements: ET1000A ...................................................................................67
Unpacking the Shipping Carton: ET1000A ....................................................................68
Rack Mount Installation: ET1000A ................................................................................68

ETEP Installation Guide 5
Connecting the Cables: ET1000A ..................................................................................69
Powering on the ET1000A .............................................................................................69
Installing the ET10000A .......................................................................................................70
Cabling Requirements: ET10000A .................................................................................71
Unpacking the Shipping Carton: ET10000A ..................................................................72
Rack Mount Installation: ET10000A ..............................................................................72
Connecting the Cables: ET10000A ................................................................................74
Powering on the ET10000A ...........................................................................................74
Safety Guidelines ......................................................................................................75
Power-Up Procedure .................................................................................................75
Shutting Down the ETEP ......................................................................................................76
Initial Setup ...............................................................................................................................79
Overview ...............................................................................................................................79
Logging In Through a Serial Link ........................................................................................79
Configuring the Management Port ......................................................................................80
Setting the Date and Time ....................................................................................................83
Entering a Throughput License .............................................................................................84
Configuration Example .........................................................................................................85
Managing the ETEP ..............................................................................................................85
Maintenance ..............................................................................................................................87
Preventative Maintenance .....................................................................................................87
What To Do If an Appliance Fails ........................................................................................87
Obtaining a License for Replacement Units ...................................................................88
Replacing a Power Supply ..............................................................................................88
Replacing the ET1000A Power Supply ....................................................................88
Replacing the ET10000A Power Supply ..................................................................89
Tamper Switch and Zeroization ............................................................................................91
Cable Pinouts ........................................................................................................................92
RS-232 Serial Cable: ET0010A and ET10000A ............................................................92
RS-232 Serial Cable: ET0100A Models .........................................................................93
Troubleshooting ........................................................................................................................95
Symptoms and Solutions ......................................................................................................95
LED Indicators ................................................................................................................95
Error State .......................................................................................................................96
Temperature Threshold and Discarded Traffic .........................................................96
Diagnostic Code Display ......................................................................................................97
Status Codes: ET0010A ..................................................................................................97
Diagnostic Codes: ET0100A Models ............................................................................98
Environmental and Regulatory Information .........................................................................99
WEEE Directive ...................................................................................................................99
RoHS Directive .....................................................................................................................99
Regulatory Information .........................................................................................................99

6ETEP Installation Guide
ET0005A Regulatory Information ..................................................................................100
Safety ........................................................................................................................100
Immunity ...................................................................................................................100
Emissions ..................................................................................................................100
FCC Information (USA) ...........................................................................................100
Interference-Causing Equipment Standard Compliance Notice (Canada) ...............100
European Notice .......................................................................................................101
ET0010A Regulatory Information ..................................................................................101
Safety ........................................................................................................................101
Immunity ...................................................................................................................101
Emissions ..................................................................................................................101
FCC Information (USA) ...........................................................................................101
Interference-Causing Equipment Standard Compliance Notice (Canada) ...............101
European Notice .......................................................................................................102
ET0100A Regulatory Information ..................................................................................102
Safety ........................................................................................................................102
Immunity ...................................................................................................................102
Emissions ..................................................................................................................102
FCC Information (USA) ...........................................................................................102
Interference-Causing Equipment Standard Compliance Notice (Canada) ...............102
European Notice .......................................................................................................103
ET0100A Cabling .....................................................................................................103
ET0100A and ET1000A Regulatory Information ..........................................................103
Safety ........................................................................................................................103
Immunity ...................................................................................................................103
Emissions ..................................................................................................................103
FCC Information (USA) ...........................................................................................103
Interference-Causing Equipment Standard Compliance Notice (Canada) ...............104
European Notice .......................................................................................................104
ET1000A Regulatory Information ..................................................................................104
Safety ........................................................................................................................104
EMI/EMC .................................................................................................................104
FCC Information (USA) ...........................................................................................104
Interference-Causing Equipment Standard Compliance Notice (Canada) ...............105
European Notice .......................................................................................................105
ET10000A Regulatory Information ................................................................................105
Environmental ...........................................................................................................105
Safety ........................................................................................................................105
FCC Information (USA) ...........................................................................................105
Interference-Causing Equipment Standard Compliance Notice (Canada) ...............105
European Notice .......................................................................................................105
Index ...........................................................................................................................................107

ETEP Installation Guide 7
About This Document
Purpose
The ETEP Installation Guide describes how to cable and install the Black Box™ ETEP Enforcement
Points.
Intended audience
This document is intended for use by network technicians and security administrators who are familiar
with setting up and maintaining network equipment.
Assumptions
This document assumes that its readers have an understanding of the following:
•Basic principles of TCP/IP networking, including IP addressing, switching and routing.
•Personal computer (PC) operation and common PC terminology
•Terminal emulation software and FTP operations.
Conventions used in this document
Bold Indicates one of the following:
•a menu title
•the name of a command
•the name of a parameter
Italics Indicates a new term
Monospaced Indicates machine text, such as terminal output or a file name
Monospaced bold Indicates a command to be issued by the user

About This Document
8ETEP Installation Guide
Contacting Customer Support
Technical support services are accessible through the Black Box support center.
FREE technical support 24 hours a day, 7 days a week: Call 724-746-5500 or fax [phone]
US (toll free) 1-877-877-BBOX
International outside U.S. call 724-746-5500
Email [email protected]m
Web www.blackbox.com

ETEP Installation Guide 9
1Product Overview
ETEP Introduction
The Black Box Enforcement Point (ETEP) Variable Speed Encryptors (VSEs) are purpose-built
encryption appliances that provide multi-layer data protection. With straightforward setup and
configuration, the ETEP has the flexibility to provide Ethernet frame encryption for Layer 2 networks, IP
packet encryption for Layer 3 networks, and Layer 4 data payload encryption for MPLS networks.
The ETEP’s variable speed capability lets you enable just the bandwidth you need, using a software
license. As your bandwidth needs increase, simply update your license. No need to replace your
hardware. The ETEP offer full-duplex, line rate encryption from 3 Mbps to 1 Gbps using the AES-256
encryption algorithm.
Figure 1 Multipoint Ethernet Encryption using EncrypTight Manager
The ETEP interfaces with network equipment through two data ports, the local port and the remote port.
Unencrypted traffic that originates from a trusted, local network is received on the local port, where the
ETEP applies security processing. Encrypted traffic is sent from the remote port to an untrusted network
such as the Internet. At the opposite endpoint, the process is reversed. Encrypted traffic is received on the
ETEP remote port and decrypted. The decrypted traffic is sent from the local port to the destination.

Product Overview
10 ETEP Installation Guide
The ETEP is managed in-line or out-of-band through a dedicated Ethernet management interface. The
ETEP can be managed in two ways, depending on the size and complexity of your deployment:
•Command Line Interface (CLI)
The CLI is all you need to manage a standalone deployment, typically a pair of ETEPs. CLI
commands are available to perform initial setup of the ETEP, along with diagnostic and
troubleshooting commands. In Layer 2 deployments, you can configure the ETEPs for operation and
create Layer 2 point-to-point policies using the CLI commands.
•EncrypTight Manager™
EncrypTight Manager is an application for managing group encryption deployments. EncrypTight
Manager separates the functions of policy management, key generation and distribution, and policy
enforcement. As a result, multiple ETEPs can use common keys. This works for complex mesh, hub
and spoke, and multicast networks, as well as in straightforward point-to-point topologies. Figure 1
shows ETEPs deployed in a multipoint Ethernet network.
EncrypTight Manager is a web application and database server that is accessed using a browser-based
GUI and supports role-based access. It is through this multi-user web user interface that the ETEP
devices are configured and policies defined. EncrypTight Manager handles the policy generation and
distribution. EncrypTight Manager offers high availability and the web-based, three-tier architecture
scales linearly. EncrypTight Manager is responsible for generating and distributing the key material
for use by the ETEP devices. It can be configured to use a Hardware Security Module (HSM) if
required for random number generation and other functions. EncrypTight Manager also provides
SNMP access to host information, and has the capability to forward logs to an administrator assigned
syslog server.
ET0005A Physical Description
The ET0005A is a multi-layer encryption appliance that provides tunnel-less data protection, including
Ethernet frame encryption for Layer 2 networks, IP packet encryption for Layer 3 networks, and Layer 4
data payload encryption for IP and MPLS networks. The ET0005A offers full-duplex encryption at
speeds up to 5 Mbps using the AES-256 algorithm.
The ET0005A is a cost-effective encryption appliance that is fully interoperable with the Black Box
ETEP family of multi-layer encryption appliances. The ET0005A uses the same standardized and FIPS
140-2 validated cryptographic algorithms as the VSE family. Environmental hardening for enclosed
outdoor environments and a very small form factor allow the ET0005A to be deployed at the network
edge where encryption was previously difficult to deploy and manage. Furthermore, the ET0005A
includes an integrated Ethernet switch, so it can switch traffic locally while encrypting traffic to and from
the wide area network. This reduces costs by avoiding the need to deploy additional Ethernet switches.
ET0005A Indicators and Connectors
The ET0005A indicators and connectors are shown in Figure 2.

ET0005A Physical Description
ETEP Installation Guide 11
Figure 2 ET0005A Indicators and Connectors
The ET0005A has five 10/100/1000 Mbit/s Gigabit Ethernet ports. The five Ethernet ports and the link
indicators are depicted in Figure 2 above.
The following table describes how to interpret the LEDs on the ET0005A.
Elements of Figure 2:
1) Power Connector
2) Reset Switch (not used)
3) Green bootloader LED
4) Blue power LED
5) DB9 RS232C asynchronous serial port (male)
6) (One) 10/100/1000 RJ45 network interface to the remote (untrusted) network
7) (Four) 10/100/1000 RJ45 locally switched network interfaces to the local (trusted)
network
Table 1 ET0005A LED Indicators
Indicator Light State Indication
Bootloader (green) Off Bootstrapping completed (a few seconds). There is a beep
that happens at the same time as this LED turns off.
On Bootstrapping process occurring at the beginning of power
up.
Power (blue) Off Device does not have power.
On Device has power.
10/100 link status (green)a
a. The link status LEDs are on the remote and local data ports, Ethernet management port, and Aux1 port.
Off Loss of signal on the 10/100 link.
On The 10/100 link is up but no traffic is passing over the link.
Blinking Indicates the presence of traffic on the 10/100 link.
Gigabit link status (amber)aOff Loss of signal on the Gigabit link.
On The Gigabit link is up but no traffic is passing over the link.
Blinking Indicates the presence of traffic on the Gigabit link.

Product Overview
12 ETEP Installation Guide
ET0010A Physical Description
The ET0010A can be licensed to run at the following speeds: 3 Mbps, 6 Mbps, 10 Mbps, 25 Mbps, and
50 Mbps. It is available in two form factors:
•Model 410-032-402 includes an Auxiliary Ethernet port on the front panel in addition to the Remote
and Local ports. This model is referred to as the ET0010A.
•Model 410-032-602 has only two data ports on the front panel (Remote and Local). This model is
referred to as the ET0010A.
Refer to the appropriate sections below for your ET0010A model.
ET0010A Physical Description
The ET0010A is a rack-mountable encryptor that can run at speeds ranging from 3-50 Mbps. It has three
data ports on the front panel labeled Remote, Local, and Aux1. The following sections describe the Black
Box ET0010A connectors and LED indicators.
Front Panel Connectors
The ET0010A front panel connectors are shown in Figure 3.
Figure 3 ET0010A Front Panel Connectors
Status Indicators
The ET0010A status indictors are shown in Figure 4. The status indications are described in Table 2.
Elements in Figure 3:
1) RS-232 management port
2) Ethernet management port
3) Auxiliary port (not enabled in this release)
4) Remote port (encrypted traffic):
5) Local port (clear traffic):

ET0010A Physical Description
ETEP Installation Guide 13
Figure 4 ET0010A Status Indicators
The following table describes how to interpret the ET0010A status indicators.
Rear Panel
The ET0010A rear panel and external power supply are shown in Figure 5.
Elements of Figure 4:
1) Power LED
2) Alarm LED
3) Status indicators
4) Link indicators
Table 2 ET0010A Status Indicators
Indicator Light State Indication
Power (green) Off Unit is powered off.
On Unit is powered on.
10/100 link status
(green)a
a. The link status LEDs are on the remote and local data ports, Ethernet management port, and Aux1 port.
Off Loss of signal on the 10/100 link.
On The 10/100 link is up but no traffic is passing over the link.
Blinking Indicates the presence of traffic on the 10/100 link.
Gigabit link status
(amber)a
Off Loss of signal on the Gigabit link.
On The Gigabit link is up but no traffic is passing over the link.
Blinking Indicates the presence of traffic on the Gigabit link.
Alarm (green) Off Normal operation.
On The unit is in an error state. This occurs when the
diagnostics detect a boot failure, a critical error threshold is
exceeded, or a FIPS test fails when the ETEP is in FIPS
mode.
Status (1,2,3,4) Off Unit is up and operational.
On Displays diagnostic codes during boot up.

Product Overview
14 ETEP Installation Guide
Figure 5 ET0010A Rear Panel and External Power Supply
ET0010A Physical Description
The ET0010A is a rack-mountable encryptor that can run at speeds ranging from 3-50 Mbps. It has two
data ports on the front panel labeled Remote and Local. The following sections describe the Black Box
ET0010A connectors and LED indicators.
Front Panel Connectors
The ET0010A front panel connectors are shown in Figure 6.
Figure 6 ET0010A Front Panel Connectors
Status Indicators
The ET0010A status indictors are shown in Figure 7. The status indications are described in Table 3.
Elements of Figure 5:
1) External power supply power connector
2) Rear panel power connector
Elements in Figure 6:
1) RS-232 management port
2) Ethernet management port
3) Remote port (encrypted traffic)
4) Local port (clear traffic)

ET0010A Physical Description
ETEP Installation Guide 15
Figure 7 ET0010A Status Indicators
The following table describes how to interpret the ET0010A status indicators.
Rear Panel
The ET0010A rear panel and external power supply are shown in Figure 8.
Elements of Figure 7:
1) Power LED
2) Alarm LED
3) Status indicators
4) Link indicators
Table 3 ET0010A Status Indicators
Indicator Light State Indication
Power (green) Off Unit is powered off.
On Unit is powered on.
10/100 link status
(green)a
a. The link status LEDs are on the remote and local data ports, Ethernet management port, and Aux1 port.
Off Loss of signal on the 10/100 link.
On The 10/100 link is up but no traffic is passing over the link.
Blinking Indicates the presence of traffic on the 10/100 link.
Gigabit link status
(amber)a
Off Loss of signal on the Gigabit link.
On The Gigabit link is up but no traffic is passing over the link.
Blinking Indicates the presence of traffic on the Gigabit link.
Alarm (green) Off Normal operation.
On The unit is in an error state. This occurs when the
diagnostics detect a boot failure, a critical error threshold is
exceeded, or a FIPS test fails when the ETEP is in FIPS
mode.
Status (1,2,3,4) Off Unit is up and operational.
On Displays diagnostic codes during boot up.

Product Overview
16 ETEP Installation Guide
Figure 8 ET0010A Rear Panel and External Power Supply
ET0100A Physical Description
The ET0100A is a rack-mountable encryptor that can run at speeds ranging from 100–250 Mbps. The
following sections describe the connectors and LED indicators that appear on the front and rear panels of
the ET0100A.
Front Panel Connectors
The ET0100A front panel connectors are shown in Figure 9.
Figure 9 ET0100A Front Panel Connectors
Elements of Figure 8:
1) Rear panel power connector
2) External power supply power connector
Elements of Figure 9:
1) Ethernet management port
2) RS-232 port
3) Remote port (encrypted traffic)
4) Local port (clear traffic)

ET0100A Physical Description
ETEP Installation Guide 17
LED Indicators
The ET0100A LED indictors are shown in Figure 10. The LED indications are described in Table 4.
Figure 10 ET0100A LED Indicators
The following table describes how to interpret the LEDs on the ET0100A front panel.
Rear Panel
The ET0100A rear panel is shown in Figure 11.
Elements of Figure 10:
1) Diagnostic display
2) Alarm LED
3) Link indicators
4) Power indictor
Table 4 ET0100A Front Panel LED Indicators
Indicator Light State Indication
Power (green) Off Unit is powered off.
On Unit is powered on.
10/100 link status (green)a
a. The link status LEDs are on the remote and local data ports, Ethernet management port, and Aux1 port.
Off Loss of signal on the 10/100 link.
On The 10/100 link is up but no traffic is passing over the link.
Blinking Indicates the presence of traffic on the 10/100 link.
Gigabit link status (amber)aOff Loss of signal on the Gigabit link.
On The Gigabit link is up but no traffic is passing over the link.
Blinking Indicates the presence of traffic on the Gigabit link.
Alarm (green) Off Normal operation.
On The unit is in an error state. This occurs when the
diagnostics detect a boot failure, a critical error threshold is
exceeded, or a FIPS test fails when the ETEP is in FIPS
mode.
Diagnostic code display On Displays diagnostic codes during boot up. After boot up, it
reflects the operational state of the appliance and error
conditions.

Product Overview
18 ETEP Installation Guide
Figure 11 ET0100A Rear Panel
ET0100A Physical Description
The ET0100A is a rack-mountable encryptor that can run at speeds ranging from 500 Mbps–1 Gbps. The
following sections describe the ET0100A connectors and LED indicators.
Front Panel Connectors
The ET0100A front panel connectors are shown in Figure 12.
Figure 12 ET0100A Front Panel Connectors
Elements of Figure 11:
1) Power receptacle
2) Fan
3) Product ID label
Elements of Figure 12:
1) RS-232 serial port
2) Ethernet management port
3) Aux1 port (not enabled in this release)
4Remote port (encrypted traffic)
5) Local port (clear traffic)

ET0100A Physical Description
ETEP Installation Guide 19
LED Indicators
The ET0100A LED indicators are shown in Figure 13. The LEDs are described in Table 5.
Figure 13 ET0100A LED Indicators
Table 5 describes how to interpret the LEDs on the ET0100A front panel.
Elements of Figure 13:
1) Power LED
2) Alarm LED
3) Diagnostic display
4) Link indicators: Ethernet management port
5) Link indicators: Aux1, Remote and Local ports
Table 5 ET0100A Front Panel LED Indicators
Indicator Light State Indication
Power (green) Off Unit is powered off.
On Unit is powered on.
Alarm (green) Off Normal operation.
On The unit is in an error state. This occurs when the
diagnostics detect a boot failure, a critical error threshold is
exceeded, or a FIPS test fails when the ETEP is in FIPS
mode.
Diagnostic code display On Displays diagnostic codes during boot up. After boot up, it
reflects the operational state of the appliance and error
conditions.
10/100 link status (green)a
a. The link status LEDs are on the remote and local data ports, Ethernet management port, and Aux1 port.
Off Loss of signal on the 10/100 link.
On The 10/100 link is up but no traffic is passing over the link.
Blinking Indicates the presence of traffic on the 10/100 link.
Gigabit link status (amber)aOff Loss of signal on the Gigabit link.
On The Gigabit link is up but no traffic is passing over the link.
Blinking Indicates the presence of traffic on the Gigabit link.

Product Overview
20 ETEP Installation Guide
Rear Panel
The ET0100A rear panel is shown in Figure 14.
Figure 14 ET0100A Rear Panel
ET1000A Physical Description
The ET1000A is a rack-mountable 1 Gbps encryptor with dual power supplies. It can operate at speeds
ranging from 500 Mbps–1 Gbps. The following sections describe the ET1000A connectors and LED
indicators.
Front Panel Connectors
The ET1000A front panel connectors are shown in Figure 15.
Figure 15 ET1000A Front Panel Connectors
Elements of Figure 14:
1) Power receptacle
2) Fan
3) Product ID label
Elements of Figure 15:
1) RS-232 serial port
2) 10/100 Ethernet management port
3) Gigabit Ethernet management port (not enabled in this release)