Black Box EncrypTight User manual

BL A C K B OX®
EncrypTight acts as a transparent overlay that
integrates easily into any existing network
architecture, providing encryption rules and keys
to EncrypTight Enforcement Points.
EncrypTight consists of a suite of tools that performs various tasks of
appliance and policy management, including Policy Manager (PM),
Key Management System (KMS), and EncrypTight Enforcement Points
(ETEPs).
EncrypTight Getting Started Guide
ET0010A
ET0100A
ET1000A
Order toll-free in the U.S.: Call 877-877-BBOX (outside U.S. call 724-746-5500)
FREE technical support 24 hours a day, 7 days a week: Call 724-746-5500 or fax [phone]
Mailing address: Black Box Corporation, 1000 Park Drive, Lawrence, PA 15055-1018
Web site: www.blackbox.com • E-mail: [e-mail]
Customer
Support
Information

1
EncrypTight — Getting Started
This guide is intended as a jump start to using the EncrypTight system. This guide assumes that you have
already installed and cabled your ETEPs and at least one ETKMS. It describes how to configure the
ETEPs and the ETKMS and the basic methods for creating Layer 2 and Layer 3 policies.
This guide includes the following topics:
●Before You Begin
●Overview - Elements of the EncrypTight System
●Setting Up ETEPs
●Configuring the ETKMS
●Starting the EncrypTight Software
●Installing the EncrypTight License
●Configuring Appliances in ETEMS
●Creating a Layer 2 Policy
●Creating a Layer 3 Policy
Before You Begin
The EncrypTight system is a licensed product. After you install the EncrypTight software, contact
Customer Support to acquire your license key. You will need to provide the EncrypTight ID. To view the
EncrypTight ID, choose Edit > License. Contact Customer Support at:
Phone: [phone]
Fax: [phone]
Email: [e-mail]
Overview - Elements of the EncrypTight System
The EncrypTight system includes:
●EncrypTight Enforcement Points (ETEPs)
ETEPs are encryption appliances that enforce the security policies that you create in the EncrypTight
Policy Manager (ETPM). In ETPM, encryption appliances are referred to as Policy Enforcement
Points (PEPs).
●One or two EncrypTight Key Management Systems (ETKMS)
The ETKMS generates encryption keys and distribute the policies to the ETEPs.

Setting Up ETEPs
2EncrypTight — Getting Started
●EncrypTight software, including EncrypTight Element Management System (ETEMS) and
EncrypTight Policy Manager (ETPM).
ETEMS is an element manager that you use to configure the ETEPs. ETPM is the policy generation
and management tool.
Setting Up ETEPs
In order to use the ETEPs, after you connect the appropriate cables, you must log in through the serial
port and use CLI commands to assign an IP address, network mask, and default gateway for the
management port. You can also set the date and time.
Logging In Through a Serial Link
Initial setup is performed through a serial link to the RS-232 port.
To log in to the CLI via a serial link:
1 Connect the RS-232 serial port directly to a PC or workstation.
2 Open a terminal session through a VT-100 terminal emulation program such as HyperTerminal. Enter
the connection name, the appropriate serial port (usually COM1 or COM2), and the following serial
port parameters:
3 In the terminal session window, press ENTER. The login prompt displays.
4 At the login prompt, type the default user name admin and press ENTER. User names and
passwords are case-sensitive.
5 At the password prompt, type the default password admin and press ENTER.
6 When you are successfully logged in, the command line prompt displays as shown below (password
text is not displayed).
pep login: admin
Password:
Last login: Tue Jan 29 19:18:59 2010 on ttyS0
Welcome admin it is Tue Jan 29 19:37:12 UTC 2010
admin>
It is recommended that you change the default passwords when you configure the ETEP for operation
using ETEMS. See the EncrypTight documentation for more information about user management.
Baud Speed 38,400
Parity None
Data Bits 8
Stop Bits 1
Flow Control None

Setting Up ETEPs
EncrypTight — Getting Started 3
CAUTION
Keep track of the passwords you assign. If you lose the admin password, you can lose the ability to
communicate with and manage the appliance. In some cases, restoring the unit to working order can
require factory service.
Initial ETEP Configuration
ETEPs can be managed in-line or out-of-band through a dedicated Ethernet management interface. To use
the ETEP in an EncrypTight deployment, the basic configuration includes specifying an IP address for the
management port and setting the date and time.
The Ethernet management port IP address identifies the ETEP to the management workstation. The
subnet mask is the portion of the IP address that identifies the network or subnetwork for routing
purposes.
When the ETEP management port and the management workstation or the ETKMS are on different
subnets, the ETEP uses a default gateway to route packets to the other devices. The default gateway
identifies the local router port that is on the same subnet as the ETEP Ethernet management port.
Figure 1 shows an example of a default gateway when the management station and ETEP are on different
subnets. The management station’s IP address is 192.168.1.10, and the ETEP’s management port IP
address is 192.168.10.10. To send packets between the two devices, the local port on Router #1 is
specified as the default gateway (192.168.10.1). The gateway address must match the subnet of the
management port.
Figure 1 Management Port Default Gateway
To configure the management port:
1 At the command prompt, type configure to enter configuration mode.
2Attheconfig> prompt, type management-interface.
3 To assign the management port IP address, mask, and gateway, type
ip <ip address> <subnet mask> [gateway]
ip address Management port IP address, entered in dotted decimal notation.
subnet mask IP subnet mask, entered in dotted decimal notation.

Configuring the ETKMS
4EncrypTight — Getting Started
After entering the new IP address, it takes 10-20 seconds for the ETEP to set the address on the
management port. During that time you cannot enter any CLI commands. When the operation is
complete, the man-if> prompt is displayed.
4 Auto-negotiation is enabled by default. If you want to disable auto-negotiation and manually set the
link speed and flow control, configure the autoneg command. For instructions, refer to the ETEP
Installation Guide.
5Type
exit to return to the config prompt.
6 The time zone on the ETEP is set to UTC 0 (Coordinated Universal Time), and is not user
configurable. At the config> prompt, type date <year> <month> <day> <hour>
<minutes> <seconds>
7Typeexit to return to the command prompt.
Example:
The following example sets the management port IP address, subnet mask, and gateway for the ETEP
as shown in Figure 1. It also sets the date and time. Auto-negotiation is left at its default setting of
enabled.
admin> configure
config> management-interface
man-if> ip 192.168.10.10 255.255.255.0 192.168.10.1
man-if> exit
config> date 2010 07 12 15 30 00
config> exit
Configuring the ETKMS
You can use either a local ETKMS or an external ETKMS. The local ETKMS is intended for use with
small to medium networks with no more than 10 nodes.
Although some of the essential configuration of the ETKMS is the same for both local a ETKMS and an
external ETKMS, the procedures for configuring each are different. For this reason, the basic
configuration of a local ETKMS is discussed separately.
Basic Configuration for a Local ETKMS
When you use a local ETKMS, the ETKMS software runs on the same workstation as the EncrypTight
software. Keep in mind the following information:
●Although the EncrypTight application does not need to remain open, the ETKMS software needs to
run continuously in order to renew keys and refresh policies. For this reason, install the EncrypTight
software on a reliable workstation. In addition, disable the Windows standby and hibernation modes.
gateway Specifies how to route traffic between the ETEP management port and the
management station or ETKMS. When the management port is on a different
subnet than the management station or ETKMS, specify the IP address of the
router’s local port on the same subnet as the ETEP management port (see
Figure 1). If the devices are on the same subnet, you do not need to enter a
default gateway.

Configuring the ETKMS
EncrypTight — Getting Started 5
The local ETKMS software cannot renew keys and refresh policy lifetimes if the workstation enters
standby or hibernation mode.
●It is strongly recommended that you assign a static IP address to the local ETKMS. If the local
ETKMS IP address does not match the management station IP address, an error is generated when
you attempt to launch the local ETKMS.
●The local ETKMS uses the time and date settings in effect on the workstation on which the
EncrypTight software is installed. Because EncrypTight is dependant on network-wide clock
synchronization, it is strongly recommended that you set up the management workstation to
synchronize with an NTP server rather than setting the date and time manually. You should use the
same time service for the EncrypTight workstation and the PEPs.
●You cannot run web server software on the same workstation as the EncrypTight software. The
ETKMS application must use port 443. Running a web service on the same workstation generates an
error message when you attempt to launch the local ETKMS.
To learn more about using a local ETKMS, see the EncrypTight User Guide.
Setting the IP address for a Local ETKMS
You set the IP address for a local ETKMS when you add the ETKMS in the ETEMS Appliance Manager.
The IP address must be the IP address of the workstation on which EncrypTight is installed.
To add a local ETKMS:
1 In the Appliance Manager, click File > New.
2 In the New Appliance editor, from the Product Family box, select ETKMS LM.
3FromtheSoftware Version box, select the appropriate software version.
4IntheAppliance Name box, enter a name for this local ETKMS.
5IntheIP Address box, enter the IP address of the workstation on which EncrypTight is installed.
6 Optionally, in the Backup IP Address box, enter the IP address of a backup ETKMS. Usually, a
backup ETKMS is used with an external ETKMS. For more information about backup ETKMSs, see
the EncrypTight User Guide.
7ClickSave.
Launching and Stopping a Local ETKMS
When you launch a local ETKMS, the ETKMS software runs as a separate application in a command line
window on the management workstation. If the management workstation running the local ETKMS
restarts, you must relaunch the local ETKMS. The local ETKMS does not have a web interface. It is
managed through ETEMS.
To launch a local ETKMS:
1 In the Appliance Manager, select the local ETKMS.
2ClickTools > Launch ETKMS LM.
The ETKMS software starts and opens a command line window.

Configuring the ETKMS
6EncrypTight — Getting Started
To stop a local ETKMS:
1 Switch to the command line window in which the local ETKMS is running.
2PressCTRL + C.
3TypeY.
Configuring an External ETKMS
After you connect the appropriate cables to the ETKMS server, you need to log in to the ETKMS, set up
the network interface with an IP address and hostname, and specify an NTP server to use. Once the
ETKMS is configured, add it to the list of appliances managed by ETEMS.
Logging Into the ETKMS
To configure the ETKMS, you must connect the monitor, keyboard, and mouse and log into the server
directly.
The ETKMS has two default user accounts, admin and root. The default password for the admin account
is admin. The default password for the root user is password. You can use the admin account to log into
the ETKMS remotely using SSH. The root user can only log into the ETKMS directly. You must log in
as root to configure the ETKMS.
To maintain the security of your system and networks, it is strongly recommended that you change the
default admin password and the default root password as one of your first tasks. The first time you log
into the ETKMS as admin, you must change the admin password.
To log into the ETKMS:
1 At the login prompt, enter a user name and press Enter.
2 At the Password prompt, enter the password and press Enter.
Change the Default Passwords
To maintain system security, it is strongly recommended that you change the default passwords for the
ETKMS administrator user (admin) and the root password periodically.
CAUTION
Keep track of the passwords you assign. If you lose these passwords, you can lose the ability to
communicate with and manage the ETKMS. In some cases, restoring the unit to working order can require
factory service.
Changing the Admin Password
The default password for the admin account is admin. Changing the default admin password is an
essential step in maintaining the security of the ETKMS and EncrypTight. The first time you log in as
admin, you must change the password. Use the following to change the password after that first log in.

Configuring the ETKMS
EncrypTight — Getting Started 7
To change the admin password:
1 Log in as admin.
2Type
passwd and press Enter.
3 At the prompt, type the current password and press Enter.
4 At the prompt, type the new password and press Enter.
The new password must be at least six characters long, contain a sufficient number of different
characters, and must not be a common dictionary word.
5 At the prompt, retype the new password and press Enter.
6Type
exit to log out from the admin account.
For example:
Localhost login: admin
Password:
[admin@localhost ~] $ passwd
(current) UNIX password:
New UNIX password:
Retype new UNIX password:
passwd: all authentication tokens updated successfully.
[admin@localhost ~] exit
Changing the Root Password
The default password for the root user is password. It is strongly recommended that you change the
default root password when you initially set up the ETKMS server. The new password for the root user
must be at least seven characters long and contain a sufficient number of different characters.
To change the root password:
1 Log in as root.
2Type
passwd and press Enter.
3 Follow the prompts to change the root password.
Remain logged in as root to complete the ETKMS configuration.
CAUTION
Keep track of the passwords you assign. If you lose these passwords, you can lose the ability to
communicate with and manage the ETKMS. In some cases, restoring the unit to working order can require
factory service.
Configure the Network Connection
You can set a static IP address using the web interface. The eth0 connection is the network connection
with a path to the management workstation containing the ETPM and to the PEPs’ management port. The
eth1 connection is inactive and unavailable. Set the network connection as required by your network
configuration.
Setting up the network connection requires running two scripts.

Configuring the ETKMS
8EncrypTight — Getting Started
To configure the network connection and hostname:
1 At the command prompt, type system-config-network.
2TabtotheEdit Devices option and press Enter.
3Tabtotheeth0 device and press Enter.
4 Make sure that DHCP is not selected (use the spacebar to clear any selection) and then enter the:
●Static IP
●Netmask
●Default Gateway IP address
5TabtoOK and press Enter.
6TabtoSave and press Enter.
7TabtoEdit DNS configuration and press Enter.
8 Enter the Hostname, Primary DNS, Secondary DNS, and Search information.
9TabtoOK and press Enter.
10 Tab to Save & Quit and press Enter.
11 At the command prompt, type /opt/etkms/bin/etc-hosts-config.sh and press Enter.
12 At the command line, restart the network service by typing service network restart and press
Enter.
13 At the command line, restart the ETKMS service by typing service etkms restart and press
Enter.
You can use the following commands to verify the IP address and hostname changes:
●At the command line, type ifconfig and press Enter to view the IP address.
●At the command line, type hostname and press Enter to view the full hostname, such as
serv4.company.com.
●Type hostname -s and press Enter to view the short hostname. In this example, if the full
hostname is serv4.company.com, the short name is serv4.
Configure Time and Date Properties
All EncrypTight components, including the ETKMS, should be synchronized with a time server. You
must be logged in as root to make these changes.
To set the time zone:
1 Edit the file
/etc/sysconfig/clock
2FortheZone value, specify the appropriate filename. Zone files are located in:
/usr/share/zoneinfo
You need to include the parent directory in the entry (for example, America/New_York).
3 Save and close the file.
To set up time synchronization:
1 Edit the file:
/etc/ntp.conf

Starting the EncrypTight Software
EncrypTight — Getting Started 9
2 Replace the lines listing the three default time servers with your preferred time server. You can
specify multiple time servers.
3 Save and close the file.
4 To set up the NTP daemon to start every time the server starts, at the command line, type:
chkconfig ntpd on
And press Enter.
Changes to the NTP settings do not take affect until you restart the NTP daemon or the entire server.
To restart the NTP daemon:
1 At the command line, type:
service ntpd restart
Starting and Stopping the ETKMS Service
The ETKMS runs as a service in Linux. Once the ETKMS is started, the ETKMS restarts after each
reboot of the Linux server.
To start the ETKMS service:
1 At the command line, type:
service etkms start
To stop the ETKMS service:
1 At the command line, type:
service etkms stop
Checking the Status of the ETKMS
You should check that the ETKMS service is running before you proceed to use EncrypTight.
To check the status of the ETKMS service:
1 At the command line, type:
service etkms status
Starting the EncrypTight Software
Only one user at a time can be logged in to ETEMS. User authentication is enabled by default. Use the
default userId and password to log in the ETEMS the first time. You can then change the default account
or disable user authentication.

Starting the EncrypTight Software
10 EncrypTight — Getting Started
To start ETEMS:
1FromtheStart menu, select All Programs > EncrypTight.
2 In the Login screen, enter the default UserId admin and Password admin. Note that the userId and
password are case sensitive.
3ClickLogin.
The ETEMS Appliance Manager opens.
Figure 2 ETEMS Appliance Manager Perspective
About User Accounts and Passwords in EncrypTight
User authentication in EncrypTight is enabled by default, and is mandatory for the ETEPs. Default user
accounts exist for both the EncrypTight software and the ETEPs.
In order for EncrypTight to communicate with the ETEP, it must know the ETEP’s user name and
password. If the user account for the ETEP does not match the user account and password that you used
when you logged into EncrypTight, you will be prompted for the ETEP user account and password.

Installing the EncrypTight License
EncrypTight — Getting Started 11
For the purposes of this Getting Started Guide, leave the default user accounts unchanged. However, to
maintain security changing the default user passwords and creating new user accounts should be one of
your first tasks.
●For information on working with EncrypTight user accounts, see Chapter 4: Managing EncrypTight
Users in the EncrypTight User Guide.
●For information on working with ETEP user accounts, see Chapter 7: Provisioning Appliances in the
EncrypTight User Guide.
Installing the EncrypTight License
The capabilities of EncrypTight and the ETEPs are controlled through the use of licenses. The license for
EncrypTight determines the number of licenses available to install on ETEPs. The ETEP license specifies
the throughput speed at which it can run.
After you install the EncrypTight software and start it up, you should enter the license so that you can
install licenses for your ETEPs as part of the configuration process. To learn more about licensing, see
the EncrypTight User Guide.
To install a license for EncrypTight:
1 In the Appliance Manager, click Edit > License.
2 In the License Manager, click Enter EncrypTight License.
3 In the EncrypTight License box, paste your license key and click OK.
4ClickOK.
Configuring Appliances in ETEMS
In order for ETEMS and ETPM to communicate with the appliances (ETEPs or a ETKMS), you need to
add them to the Appliance Manager. This includes specifying the management port IP address of each
appliance. It is also strongly recommended that you specify an NTP server with which the PEPs can
synchronize.
Configuring a New ETEP in ETEMS
You configure new appliances using the Appliance Manager perspective in ETEMS.

Configuring Appliances in ETEMS
12 EncrypTight — Getting Started
Figure 3 New Appliance Interface Configuration tab
To configure the ETEP in ETEMS:
1 In the Appliance Manager, click File > New Appliance.
The New Appliance editor opens (see Figure 3).
2 In the editor, select the Product Family and Software Version, for example ET0100A and ETEP 1.5.
3OntheInterfaces tab, enter an Appliance Name to identify the appliance.
4IntheThroughput Speed box, enter the speed at which this ETEP is licensed to run.
5OntheInterfaces tab, configure the management port interface with an IP address, subnet mask, and
a default gateway.
6OntheFeatures tab, Enable EncrypTight and Enable TLS in the clear should be checked. These
are default settings for ETEPs.
7OntheFeatures tab, specify whether you want the ETEP to operate as a Layer 2 (Ethernet) PEP or a
Layer 3 (IP) PEP.
8OntheAdvanced tab, select Enable SNTP Client and enter the IP address of the NTP service to use.
(This step is optional, but strongly recommended.)
9ClickSave.
10 Click to push the configuration to the ETEP.
NOTE
●These are the minimum steps necessary to configure an ETEP to be used in EncrypTight. Depending
on the networks and the complexity of a deployment, other settings may need to be specified. For
complete information about configuring encryption appliances, see the EncrypTight User Guide.
●If you plan to operate the ETEP in FIPS mode, we recommend enabling FIPS mode as one of your
first configuration tasks. Entering FIPS mode resets many configuration items, such as passwords,

Creating a Layer 2 Policy
EncrypTight — Getting Started 13
policies, and certificates. To avoid having to reconfigure the ETEP, enable FIPS mode before you
proceed to other appliance and policy configuration tasks. For more information about FIPS mode, see
the EncrypTight User Guide and the ETEP CLI User Guide.
Add the ETKMS in ETEMS
To create and distribute policies and keys to the PEPs, you need to identify the ETKMS in the ETEMS
Appliance Manager. This involves specifying the IP address and name of the ETKMS.
To add the ETKMS in ETEMS:
1 In the Appliance Manager, click File > New Appliance.
2 In the editor, select ETKMS from the Product Family box and then make the appropriate selection
from the Software Version box.
3IntheAppliance Name box, enter a name to identify this ETKMS.
4IntheIP Address box, enter the IP address.
5IntheBackup IP Address box, enter the IP address of the backup ETKMS, if you use a backup
ETKMS.
6ClickSave.
Creating a Layer 2 Policy
The following sections summarize how to create a Layer 2 Mesh policy, using the example illustrated in
Figure 4. Layer 2 policies include ETEPs configured as Layer 2 PEPs and optional VLAN IDs.
Figure 4 Sample Layer 2 Mesh Policy

Creating a Layer 2 Policy
14 EncrypTight — Getting Started
When you add an ETEP in ETEMS, you must configure it to operate as a Layer 2 PEP. PEPs configured
to operate at Layer 3 cannot be used in Layer 2 policies, and vice-versa.
In a Layer 2 Mesh policy, you can encrypt all traffic or only the traffic that uses specific VLAN ID tags.
In this example, the policy will encrypt all traffic.
Adding Layer 2 ETEPs in ETEMS
To add Layer 2 ETEPs:
1 Follow the instructions in “Configuring a New ETEP in ETEMS” on page 11 and at step 6, click
Layer 2:Ethernet.
Creating a Layer 2 Mesh Policy
In the ETPM perspective, create the Layer 2 Mesh Policy using the ETEPs.
To switch to the ETPM perspective:
1 From the ETEMS Appliance Manager, click Window > Open > ETPM.
Figure 5 ETPM Perspective
To create Layer 2 Mesh policy:
1 Right-click in the Policy View and select Add Layer 2 Mesh Policy from the shortcut menu.
The Mesh Policy editor opens (see Figure 6).
2IntheName box, type a unique name to identify the policy.
You can use up to 40 alphanumeric characters and include spaces. You cannot use the following
special characters: < > & “ * ? / \ : |
3InthePriority box, enter the priority of the policy from 1 to 65000. Policies are processed in
descending order (from the highest to the lowest priority).
4IntheRenew keys/Refresh lifetime settings, do one of the following:

Creating a Layer 2 Policy
EncrypTight — Getting Started 15
aClick Hours and in the Hours box, enter the rekey interval in hours between 0 and 65535. You
can use 0 to ensure that the policy never expires and never updates.
Or,
bClick Daily and in the Daily box, enter the time of day at which you want the policy to be
rekeyed and refreshed. Enter the time using the 24 hour system clock relative to the local time of
the ETPM workstation. The setting will be translated to the local times of the ETKMS and PEPs
that are located in other time zones.
5 Click the type of action the policy enforces on the traffic, Drop, Bypass (send in the clear), or
Encrypt.
6 From the PEPs tab, click and drag the PEPs that you want to use to the PEPs box in the editor.
7ClickSave.
8ClickDeploy .
Note that you cannot deploy policies if any policy has a configuration error in the policy or a policy
component. Errors are indicated with a .
Figure 6 Layer 2 Mesh Policy Editor

Creating a Layer 3 Policy
16 EncrypTight — Getting Started
Creating a Layer 3 Policy
The following sections summarize how to create a Layer 3 Mesh IP policy, using the example in Figure
7.
Figure 7 Sample Mesh IP policy
Add Networks in ETPM
In the ETPM perspective, add the networks that you want to protect.
To switch to the ETPM perspective:
1 From the ETEMS Appliance Manager, click Window > Open > ETPM (see Figure 5).
To add a network:
1 Right-click anywhere in the Networks tab and click Add New Element (see Figure 8).
2 In the editor, in the Network IP address box, enter an IP address to identify the network.
3IntheNetwork Mask box, enter the subnet mask for the network.
4ClickSave when complete.

Creating a Layer 3 Policy
EncrypTight — Getting Started 17
Figure 8 Networks - Add New Element
Add Network Sets
In ETPM, create the network sets that you need. Network sets can include a single network or multiple
networks, one or more PEPs, and a default ETKMS. Typically, network sets represent a site or a branch
office.
To add a network set:
1 Right-click anywhere in the Network Set tab and click Add New Element.
The Network Set editor opens (see Figure 9).
2IntheName box, enter a name for this network set.
3FromtheNetworks tab, click and drag the appropriate networks to the Networks box in the editor.
4FromthePEPs tab, click and drag the appropriate PEPs to the PEP box in the editor.
5FromtheDefault ETKMS box, select the ETKMS that you want to use.
6 For the Network Addressing Mode, most of the time you will accept the default and use the network
IP address. To learn about other options, see the EncrypTight User Guide, beginning with Chapter 2:
EncrypTight Deployment Planning.
7ClickSave.

Creating a Layer 3 Policy
18 EncrypTight — Getting Started
Figure 9 Network Set editor
Create the Policy
You create policies in ETPM by:
●Selecting the network topology
●Specifying the priority
●Setting the policy refresh and key renewal schedule
●Specifying the action to take
●Selecting the encryption and authentication algorithms
●Adding the elements involved
●Specifying the kind of traffic the policy affects
Other settings are possible, but not covered in this Getting Started Guide.

Creating a Layer 3 Policy
EncrypTight — Getting Started 19
To create a Layer 3 Mesh policy:
1 Right-click in the Policy View and select Add Mesh Policy from the shortcut menu.
The Mesh Policy editor opens (see Figure 10).
2IntheName box, type a unique name to identify the policy.
You can use up to 40 alphanumeric characters and include spaces. You cannot use the following
special characters: < > & “ * ? / \ : |
3InthePriority box, enter the priority of the policy from 1 to 65000. Policies are processed in
descending order (from the highest to the lowest priority).
4IntheRenew keys/Refresh lifetime settings, do one of the following:
aClick Hours and in the Hours box, enter the rekey interval in hours between 0 and 65535. You
can use 0 to ensure that the policy never expires and never updates.
Or,
bClick Daily and in the Daily box, enter the time of day at which you want the policy to be
rekeyed and refreshed. Enter the time using the 24 hour system clock relative to the local time of
the ETPM workstation. The setting will be translated to the local times of the ETKMS and PEPs
that are located in other time zones.
5 Click the type of action the policy enforces on the traffic, Drop, Bypass (send in the clear), or IPsec
(encrypt).
6FromtheEncryption Algorithm box, select the encryption algorithm to use.
7FromtheAuthentication Algorithm box, select the authentication algorithm to use.
8 Do one of the following:
aTo specify that keys are generated by the ETKMS that is part of each network set, click By
Network Set.
bTo specify that all of the keys for the policy are generated by a single ETKMS, click Global
ETKMS and select the ETKMS from the list.
9 For the Addressing Mode Override, most of the time you will accept the default and use the network
IP address. To learn about other options, see the EncrypTight User Guide, beginning with Chapter 2:
EncrypTight Deployment Planning.
10 Do not make a selection from the Minimize Police Size section. To learn about these options, see the
EncrypTight User Guide, Chapter 16: Creating Distributed Key Policies.
11 From the Network Set tab, click and drag the appropriate network sets into the Network Sets box in
the Mesh policy editor.
12 Optionally, to specify that the policy only applies to traffic using a specific Layer 3 protocol, click
Only and enter the number of the protocol.
13 Click Save.
14 Click Deploy .
Note that you cannot deploy policies if any policy has a configuration error in the policy or a policy
component. Errors are indicated with a .