Black Box ET0100A User manual

BL A C K B OX®
EncrypTight acts as a transparent overlay that
integrates easily into any existing network
architecture, providing encryption rules and keys
to EncrypTight Enforcement Points.
EncrypTight consists of a suite of tools that performs various tasks of
appliance and policy management, including Policy Manager (PM),
Key Management System (KMS), and EncrypTight Enforcement Points
(ETEPs).
ETEP Command-Line Interface (CLI) User Guide
ET0010A
ET0100A
ET1000A
Order toll-free in the U.S.: Call 877-877-BBOX (outside U.S. call 724-746-5500)
FREE technical support 24 hours a day, 7 days a week: Call 724-746-5500 or fax [phone]
Mailing address: Black Box Corporation, 1000 Park Drive, Lawrence, PA 15055-1018
Web site: www.blackbox.com • E-mail: [e-mail]
Customer
Support
Information

ETEP CLI User Guide 3
Contents
Preface......................................................................................................................................... 9
About This Document.............................................................................................................................9
Contacting Black Box Technical Support ............................................................................................. 10
Chapter 1: Getting Started ....................................................................................................... 11
ETEP Introduction ................................................................................................................................ 11
Managing the ETEP ............................................................................................................................. 12
Default User Names and Passwords............................................................................................. 13
Prerequisites..................................................................................................................................13
Logging in to the Command Line Interface ..........................................................................................13
Logging in through a Serial Link .................................................................................................... 14
CLI Usage Tips.............................................................................................................................. 14
Next Steps............................................................................................................................................ 15
Chapter 2: User Administration............................................................................................... 17
Overview .............................................................................................................................................. 17
Password Enforcement Options...........................................................................................................17
Setting the Password Enforcement Policy..................................................................................... 18
Cautions for Strong Password Enforcement ................................................................................. 19
Upgrading Software ................................................................................................................20
Removing ETEPs From Service ............................................................................................. 20
Adding Users........................................................................................................................................ 20
Understanding User Roles ............................................................................................................21
User Name Conventions ...............................................................................................................22
Creating a New User: Default Password Enforcement Policy .......................................................22
Creating a New User: Strong Password Enforcement Policy........................................................ 23
Modifying Users.............................................................................................................................24
Deleting Users ...............................................................................................................................25
Viewing a List of Users ..................................................................................................................26
Assigning Passwords ...........................................................................................................................26
Assigning Passwords to Users ...................................................................................................... 27
Changing Your Own Password .....................................................................................................28
Enabling and Disabling Accounts.........................................................................................................29
Restoring an Account .................................................................................................................... 29
Disabling an Account.....................................................................................................................29
Login Failures ................................................................................................................................ 30
Using the Login Banner........................................................................................................................ 30
Audit Logging .......................................................................................................................................32
Using Common Access Cards for User Authorization .........................................................................32
Chapter 3: Configuring the ETEP ............................................................................................ 35
Configuration Overview........................................................................................................................35
Basic Configuration .............................................................................................................................. 36

4ETEP CLI User Guide
Contents
Configuring the Management Port.................................................................................................36
Setting the Date and Time.............................................................................................................40
Entering the Throughput License .................................................................................................. 40
Changing the Auto-negotiation Settings on the Local and Remote Ports .....................................41
Setting Loss of Signal Pass Through ............................................................................................ 43
Changing the CLI Inactivity Time-out ............................................................................................44
Configuration Examples ................................................................................................................44
Layer 2 Configuration...........................................................................................................................45
Assigning a VLAN Tag .................................................................................................................. 45
Verifying Transparent Mode ..........................................................................................................46
Layer 3 Configuration...........................................................................................................................47
Interoperating with the Network.....................................................................................................47
Reassembling Fragmented Packets .......................................................................................48
DF Bit Handling .......................................................................................................................49
IPv6 Traffic Handling...............................................................................................................50
Using DHCP Relay on a Remote Network..............................................................................50
Configuring Transparent Mode for Layer 3 Policies ...................................................................... 52
Assigning Remote and Local Port IP Addresses ....................................................................52
Configuring Transparent Mode ...............................................................................................53
Shutting Down the ETEP .....................................................................................................................54
Chapter 4: Creating Policies ....................................................................................................57
Creating Layer 2 Point-to-Point Policies ..............................................................................................57
Defining a Layer 2 Point-to-Point Policy ........................................................................................58
Configuring the Policy Mode..........................................................................................................59
Layer 2 Policy Example .................................................................................................................60
Verifying the Policy ........................................................................................................................62
How the ETEP Encrypts and Authenticates Layer 2 Traffic .......................................................... 63
Creating Local Site Policies ................................................................................................................. 64
Policy Configuration....................................................................................................................... 65
Assigning Policy Names..........................................................................................................66
Configuring a Local Site Bypass or Discard Policy .................................................................67
Configuring a Local Site Encryption Policy .............................................................................69
Policy Deployment.........................................................................................................................72
Viewing the Local Site Policy Set............................................................................................72
Making a Backup Copy of the Local Site Policy Set ...............................................................73
Deploying Local Site Policies ..................................................................................................73
Managing Local Site Policies.........................................................................................................74
Modifying a Local Site Policy ..................................................................................................74
Deleting a Local Site Policy.....................................................................................................74
Clearing the Local Site Policy Set ...........................................................................................74
Restoring the Local Site Policy Set .........................................................................................75
Policy Examples ............................................................................................................................ 75
Bypass Policy for Routing Protocols .......................................................................................76
Encryption Policy for Layer 2 Ethertype .................................................................................. 77
Securing Management Port Traffic with IPsec .....................................................................................77
Task Overview............................................................................................................................... 78
IPsec Client Task Summary....................................................................................................78
ETEP Task Summary..............................................................................................................78
Configuring Global Settings for IKE Negotiations ..........................................................................79
Changing the IKE Parameters ................................................................................................79
Viewing the Current IKE Parameter Settings ..........................................................................81

Contents
ETEP CLI User Guide 5
Policy Configuration....................................................................................................................... 82
Assigning Policy Names..........................................................................................................83
Configuring an IKE Encryption Policy ..................................................................................... 84
Configuring a Manual Key Encryption Policy ..........................................................................86
Configuring a Bypass or Discard Policy on the Management Port .........................................89
Deploying Policies ......................................................................................................................... 90
Viewing the Policy Set.............................................................................................................91
Backing Up the Policy Set.......................................................................................................91
Deploying Management Policies.............................................................................................92
Managing Policies .........................................................................................................................92
Modifying a Policy ................................................................................................................... 92
Deleting a Policy .....................................................................................................................93
Clearing the Policy Set............................................................................................................93
Restoring the Policy Set..........................................................................................................94
Policy Examples ............................................................................................................................ 94
IKE Policy Example.................................................................................................................95
Manual Key Policy Example.................................................................................................... 96
Bypass Policy Example...........................................................................................................96
Discard Policy Example ..........................................................................................................96
Deploying Policies...................................................................................................................96
Chapter 5: Maintenance ........................................................................................................... 99
Installing ETEP Software Updates ....................................................................................................... 99
File System Backup and Restore.........................................................................................................99
Restoring the Factory Configuration ..................................................................................................100
Changing the Port Status ...................................................................................................................101
Chapter 6: Troubleshooting................................................................................................... 103
Symptoms and Solutions ...................................................................................................................103
Management Troubleshooting.....................................................................................................104
User Configuration Troubleshooting............................................................................................105
Traffic Troubleshooting................................................................................................................ 106
Policy Troubleshooting ................................................................................................................107
Error State ...................................................................................................................................109
Diagnostic Commands .......................................................................................................................109
Show Commands ........................................................................................................................110
Network Tools..............................................................................................................................111
Checking for Time Synchronization Problems.............................................................................112
Determining the Cause of Dropped Packets ...............................................................................112
Additional Diagnostic Tools................................................................................................................114
Port Status...................................................................................................................................115
Discarded Packets.......................................................................................................................115
Encryption Statistics ....................................................................................................................116
MAC Statistics .............................................................................................................................116
Policy and Security Association Databases ................................................................................117
Viewing the SPD Entries .......................................................................................................117
Viewing the SAD Entries .......................................................................................................118
Chapter 7: FIPS 140-2 Level 2 Operation.............................................................................. 121
FIPS Mode Requirements ...........................................................................................................121
Entering FIPS Mode ....................................................................................................................122

6ETEP CLI User Guide
Contents
FIPS Mode Failures and Zeroization ...........................................................................................123
Other Operating Boundaries........................................................................................................123
Exiting FIPS Mode.......................................................................................................................123
Chapter 8: Command Reference ........................................................................................... 125
CLI Overview......................................................................................................................................125
Format Conventions ....................................................................................................................125
Tips on Command Usage ............................................................................................................126
Commands......................................................................................................................................... 127
autoneg........................................................................................................................................128
backup-policy-set.........................................................................................................................130
banner-config...............................................................................................................................131
clear-certificates ..........................................................................................................................131
clear-known-hosts .......................................................................................................................132
clear-policies................................................................................................................................ 133
clear-policy-set ............................................................................................................................133
cli-inactivity-timer .........................................................................................................................134
configure......................................................................................................................................135
date..............................................................................................................................................135
debug-shell ..................................................................................................................................136
deploy-policy-set..........................................................................................................................137
dfbit-ignore...................................................................................................................................138
dhcprelay ..................................................................................................................................... 139
disable-trusted-hosts ...................................................................................................................140
exit ............................................................................................................................................... 141
filesystem-download ....................................................................................................................141
filesystem-reset ...........................................................................................................................143
fips-mode-enable.........................................................................................................................144
help..............................................................................................................................................145
ike-params-set.............................................................................................................................145
ike-sa-dh-group ...........................................................................................................................146
ike-sa-lifetime .............................................................................................................................. 146
ike-sa-presharedkey ....................................................................................................................147
ip..................................................................................................................................................148
ip6................................................................................................................................................150
ipsec-config .................................................................................................................................151
ipsec-sa-lifetime...........................................................................................................................152
ipsec-sa-pfs .................................................................................................................................152
ipv6Traffic ....................................................................................................................................153
layer2-p2p....................................................................................................................................154
license .........................................................................................................................................155
local-interface ..............................................................................................................................156
local-site-policies .........................................................................................................................157
logon-banner-enable ...................................................................................................................157
management-interface.................................................................................................................158
network-tools ...............................................................................................................................158
password .....................................................................................................................................159
password-enforcement ................................................................................................................160
password-modify .........................................................................................................................161
ping..............................................................................................................................................161
ping6............................................................................................................................................163
policies......................................................................................................................................... 165
policy-action.................................................................................................................................165

Contents
ETEP CLI User Guide 7
policy-add ....................................................................................................................................166
policy-config.................................................................................................................................167
policy-delete ................................................................................................................................168
policy-ike-ipsec ............................................................................................................................169
policy-ike-peer .............................................................................................................................170
policy-keying................................................................................................................................171
policy-layer2-selector...................................................................................................................172
policy-manual-key (local-site policies) .........................................................................................173
policy-manual-key (management IPsec policies) ........................................................................ 174
policy-mode .................................................................................................................................176
policy-packet-count......................................................................................................................177
policy-priority ...............................................................................................................................178
policy-selector..............................................................................................................................179
port-enable ..................................................................................................................................181
reassembly ..................................................................................................................................181
reboot ..........................................................................................................................................182
remote-interface ..........................................................................................................................183
remote-user-cert-auth-mode........................................................................................................183
restart-ike.....................................................................................................................................184
restore-filesystem ........................................................................................................................185
restore-policy-set .........................................................................................................................186
show ............................................................................................................................................187
show-ike-params .........................................................................................................................189
show-policy-set ............................................................................................................................189
shutdown .....................................................................................................................................190
snmpv3-engine-id-seed ...............................................................................................................191
ssh-enable ................................................................................................................................... 192
strict-client-authentication............................................................................................................193
top................................................................................................................................................194
traceroute ....................................................................................................................................194
transparent-mode-enable ............................................................................................................196
tx-enable......................................................................................................................................197
update-filesystem ........................................................................................................................198
user-add ......................................................................................................................................199
user-config...................................................................................................................................201
user-delete...................................................................................................................................201
user-enable..................................................................................................................................202
user-modify..................................................................................................................................203
vlan-tag........................................................................................................................................205
Index......................................................................................................................................... 207

8ETEP CLI User Guide
Contents

ETEP CLI User Guide 9
Preface
About This Document
Purpose
The ETEP CLI User Guide describes how to use the command line interface to configure and manage
Black Box™ ETEP EncrypTight Enforcement Points, define and deploy point-to-point IKE policies, and
perform troubleshooting tasks.
Intended audience
This document is intended for use by network technicians and security administrators who are familiar
with setting up and maintaining network equipment.
Assumptions
This document assumes that its readers have an understanding of the following:
●Basic principles of TCP/IP networking, including IP addressing, switching and routing.
●Personal computer (PC) operation and common PC terminology
●Terminal emulation software and FTP operations.
Conventions used in this document
Bold Indicates one of the following:
●a menu title
●the name of a command
●the name of a parameter
Italics Indicates a new term
Monospaced Indicates machine text, such as terminal output or a file name
Monospaced bold Indicates a command to be issued by the user

Preface
10 ETEP CLI User Guide
Contacting Black Box Technical Support
Contact our FREE technical support, 24 hours a day, 7 days a week:
Phone [phone]
Fax [phone]
e-mail [email protected]
Web site www.blackbox.com

ETEP CLI User Guide 11
1Getting Started
This section includes the following topics:
●ETEP Introduction
●Managing the ETEP
●Logging in to the Command Line Interface
●Next Steps
ETEP Introduction
The EncrypTight Enforcement Point (ETEP) Variable Speed Encryptors (VSEs) are high performance,
purpose-built encryption appliances that provide encrypted throughput at wire-speed. The ETEP’s high-
speed processing capabilities protect data in transit between sites while it travels over untrusted networks.
With straightforward setup and configuration, the ETEP has the flexibility to provide Ethernet frame
encryption for Layer 2 networks, IP packet encryption for Layer 3 networks, and Layer 4 data payload
encryption for MPLS networks.
The ETEP’s variable speed capability lets you enable just the bandwidth you need, using a software
license. As your bandwidth needs increase, simply update your license. No need to replace your
hardware. The ETEPs offer full-duplex, line rate encryption from 3 Mbps to 1 Gbps using the AES-256
encryption algorithm.
Figure 1 Point-to-point encryption over a Layer 2 Ethernet network

Getting Started
12 ETEP CLI User Guide
The ETEP interfaces with network equipment through two data ports, the local port and the remote port.
Unencrypted traffic that originates from a trusted, local network is received on the local port, where the
ETEP applies security processing to it. The encrypted traffic is then sent from the remote port to an
untrusted network such as the Internet. At the opposite endpoint the process is reversed. Encrypted traffic
is received on the ETEP remote port and decrypted. Then the decrypted traffic is sent from the local port
to the destination.
The ETEP is managed in-line or out-of-band through a dedicated Ethernet management interface.
Managing the ETEP
The ETEP can be managed in two ways, depending on the size and complexity of your deployment.
Several options are available for securing management traffic based on the management option that you
choose.
●Command Line Interface (CLI)
CLI commands are available to perform initial setup of the ETEP, along with diagnostic and
troubleshooting commands. In point-to-point deployments, you can configure the ETEPs for operation
and create policies using the CLI commands.
●EncrypTight Policy and Key Manager™
EncrypTight separates the functions of policy management, key generation and distribution, and
policy enforcement. As a result, multiple ETEPs can use common keys. This works for complex
mesh, hub and spoke, and multicast networks, as well as in straightforward point-to-point topologies.
EncrypTight includes the following components:
●ETEMS for appliance configuration and management
●ETPM for policy definition and deployment
●ETKMS for key generation and distribution
This manual describes how to configure, manage, and troubleshoot the ETEP using the command line
interface. If you are using EncrypTight to manage your ETEPs, see the documentation for that product to
learn how to configure appliances and deploy policies.
CLI sessions can be secured in three ways:
●Attach a PC directly to the serial port
●Use any SSH client for a secure remote connection through the Ethernet management port.
If you wish to limit remote access to the ETEP after it has been put into service, you can disable SSH
(see “ssh-enable” on page 192).
●Use IPsec to secure the management port traffic
Most management port communications are secured using SSH and TLS. If you wish, you can create
IPsec policies on the management port to provide security for traffic that is not protected by SSH and
TLS, such as FTP traffic, SNMP traffic, and the NTP protocol. To learn how to create IPsec policies
on the management interface, see “Securing Management Port Traffic with IPsec” on page 77.

Logging in to the Command Line Interface
ETEP CLI User Guide 13
Default User Names and Passwords
The ETEP has two roles: Administrator and Ops.
●The Administrator manages users, configures the appliance, and creates and deploys policies.
●The Ops user has access to a limited set of commands for initial appliance configuration, status
reporting and diagnostics.
When first installing the ETEP, use the default Administrator password to log in, as shown in Table 1. It
is strongly recommended that the Administrator change the default passwords before putting the ETEP
into operation in the network.
Related topics:
●“Overview” on page 17
●“Assigning Passwords” on page 26
Prerequisites
Make sure that the following installation tasks are complete before configuring the ETEP:
●Install the required user-supplied software on the management workstation, as described in the
Installation Guide
●Make sure that the firewalls in your system are configured to allow for the protocols required for your
deployment, as listed in the Installation Guide.
●Attach the network cables and power cord
●Power up the appliance and verify that the unit is operational
For more information about installing your ETEP, refer to the ETEP Installation Guide.
Logging in to the Command Line Interface
To manage the ETEP using the CLI, you can attach a PC directly to the serial port or use any SSH client
for a secure remote connection through the Ethernet management port. Initial setup is performed through
the serial port.
Table 1 Default user names and passwords on the ETEP
Role Default user name Default password
Administrator admin admin
Ops ops ops

Getting Started
14 ETEP CLI User Guide
Logging in through a Serial Link
Initial setup is performed through a serial link to the RS-232 port.
To log in to the CLI via a serial link:
1 Connect the RS-232 serial port directly to a PC or workstation, as described in Chapter 2.
2 Open a terminal session through a VT-100 terminal emulation program such as HyperTerminal. Enter
the connection name, the appropriate serial port (usually COM1 or COM2), and the following serial
port parameters:
3 In the terminal session window, press ENTER. The login prompt displays.
Linux 2.6.16.17 on mips
pep login:
4 At the login prompt, type the user name and press ENTER. User names and passwords are case-
sensitive. See “Default User Names and Passwords” on page 13 for a list of default account settings.
5 At the password prompt, type your password and press ENTER.
6 When you are successfully logged in, the command line prompt displays as shown below (password
text is not displayed).
pep login: admin
Password:
Last login: Tue Jan 29 19:18:59 2008 on ttyS0
Welcome admin it is Tue Jan 29 19:37:12 UTC 2008
admin>
CLI Usage Tips
The commands that are described in this manual are presented using the following format conventions.
●Arguments are shown in monospaced type, and must be entered exactly as they appear in the text.
●Brackets [ ] indicate that the enclosed parameter is optional.
●Braces { } indicate that the enclosed arguments or parameters are required.
●Arguments separated by the vertical bar | indicate that any one of the arguments may be used. For
example, a | b means enter a or b, but not both.
●Parameters that a user needs to enter are enclosed in angle brackets < >. For example, <ipAddress>
indicates that the user needs to enter an IP address, such as 192.168.1.1.
●Commands, arguments and parameters are not case-sensitive. For example, show, SHOW, and Show
are all accepted as the same command.
Baud Speed 38,400
Parity None
Data Bits 8
Stop Bits 1
Flow Control None

Next Steps
ETEP CLI User Guide 15
●When entering a command with several optional parameters, you must enter all of the optional
parameters up to and including the parameter of interest. Subsequent optional parameters will be left
at their default settings.
Auto-completion can save time when entering commands, and online help is available to display syntax
options.
●The TAB and ENTER keys perform auto-completion for the current command line.
●Context sensitive help is available by typing a question mark (?). This provides either a list of
possible command completions with summaries, or the full syntax of the current command.
The CLI has several hierarchy levels. The exit command leaves the current CLI mode and returns to the
previous hierarchy level. The top command returns to command mode from any level.
●Command mode is the login hierarchy level. Copy commands, show commands, and most
maintenance commands are accessed at this level.
●Configuration mode is where commands are entered to configure the appliance. Enter configuration
mode by typing configure. From this level you can access several additional configuration modes for
interface settings, policies, and user administration.
For more information about CLI usage and commands, see Chapter 8, “Command Reference” on
page 125.
Next Steps
To prepare the ETEP for operation in the network, you will need to perform the tasks outlined in Table 2.
If you plan to operate the ETEP in FIPS mode, we recommend enabling FIPS mode as your first
configuration task. Entering FIPS mode resets many configuration items, such as passwords, policies, and
certificates. To avoid having to reconfigure the ETEP, enable FIPS mode and then perform the rest of the
appliance and policy configuration tasks. See “FIPS 140-2 Level 2 Operation” on page 121 for more
information.
Table 2 Preparing the ETEP for operation
Step See Chapter...
1Perform user administration tasks
- Add users and assign passwords
“User Administration” on page 17
2Configure the ETEP
- Interface settings
- System settings
- Network interoperability settings
“Configuring the ETEP” on page 35
3Define security policies “Creating Policies” on page 57

Getting Started
16 ETEP CLI User Guide

ETEP CLI User Guide 17
2User Administration
This section contains the following topics:
●Overview
●Password Enforcement Options
●Adding Users
●Assigning Passwords
●Enabling and Disabling Accounts
●Using the Login Banner
●Audit Logging
●Using Common Access Cards for User Authorization
Overview
The Administrator controls and monitors access to the ETEP. The following tasks should be performed
prior to putting the ETEP into operation in the network:
●Select the password enforcement policy
●Add users, including assigning a user name and role to each user
●Change the default passwords
In addition, the Administrator can enable a login banner, and restore a disabled account.
Password Enforcement Options
In addition to assigning a name and role to a user, the Administrator can configure the password
enforcement policy, which determines the following:
●Strength of password rules and conventions
●Password expiration period, expiration warning notification, and grace period
●Maximum number of concurrent user logins allowed
●Login failure limits

User Administration
18 ETEP CLI User Guide
The default password controls are less stringent than the strong password controls, and use standard
values for password expiration and maximum number of user logins. The default password controls are
enforced on the ETEP unless you explicitly enable strong enforcement.
Strong password controls enforce more stringent password conventions, limit the reuse of passwords, and
allow the Administrator to configure the following items:
●Password expiration: the maximum number of days before the password expires.
●Password minimum: the minimum number of days that users must wait before changing their own
password.
●Password warning: the number of days prior to password expiration that a warning is given to a user.
●Expiration grace period: the number of days after the password expires that a user can log in using the
expired password.
●Maximum login sessions: the maximum number of concurrent sessions allowed per user on the ETEP.
The values used for the password expiration settings depend on the ETEP’s password enforcement policy,
as shown in Table 3.
Related topics:
●“Setting the Password Enforcement Policy” on page 18
●“Creating a New User: Default Password Enforcement Policy” on page 22
●“Creating a New User: Strong Password Enforcement Policy” on page 23
●“Assigning Passwords to Users” on page 27
Setting the Password Enforcement Policy
The default password controls are enforced on the ETEP unless you explicitly enable strong enforcement.
Strong password controls enforce more stringent password rules and conventions than the default
password controls. The strong controls affect the following items:
●Password conventions
●Password history exclusion, which limits the reuse of passwords
●Password expirations, warnings, and grace periods
●Maximum number of login sessions allowed per user
●Login failure limits
Table 3 Password enforcement values
Parameter
Default password
enforcement Strong password enforcement
Password expiration 99999 days Default is 60. Range is 1-60.
Password reset minimum 0 days Default is 1. Range is 1-7.
Password warning 7 days Default is 10. Range is 1-30.
Password grace period 0 days Default is 10. Range is 1-30.
Maximum login sessions Unlimited Default is 2. Range is 1-5.

Password Enforcement Options
ETEP CLI User Guide 19
The strong password controls are enforced on any password that is entered after strong password
enforcement is enabled. Existing user accounts can continue to use their old passwords, and the accounts
retain their default password expiration settings until the user is modified in strong password mode.
Enabling strong password enforcement restarts the SSH daemon, closing any open SSH connections. It
can take up to 30 seconds to establish an SSH connection after enabling strong passwords.
When the ETEP is switched from strong to default password controls, users’ password expiration settings
are reset to the default values listed in Table 3.
To change the password controls:
1 Enter user configuration mode.
admin> configure
config> user-config
user-config>
2 Set the password controls by configuring the password-enforcement command. Attributes are
described in Table 4.
password-enforcement {default | strong}
Example
This example enables strong password controls.
user-config> password-enforcement strong
Related topic:
●“Password Enforcement Options” on page 17
●“Cautions for Strong Password Enforcement” on page 19
●“Default Password Conventions” on page 27
●“Strong Password Conventions” on page 27
Cautions for Strong Password Enforcement
The password expiration feature puts you at risk for a lockout under certain circumstances. Review the
guidelines below to avoid unintended lockouts.
CAUTION
If the Administrators’ passwords expire, all Administrator functionality is lost, including the ability to assign
a new password. The only means of resetting the password is to reformat the ETEP, which reverts all
configurations to their default shipping settings. Reformatting the ETEP requires factory service.
Table 4 password-enforcement command description
Attribute Description
default Enforces the default password controls.
strong Enforces the strong password controls.

User Administration
20 ETEP CLI User Guide
Upgrading Software
To avoid having strong passwords expire during an upgrade process, we recommend minimizing the time
period between a software upgrade operation and reboot.
If you plan to wait a day or more between an upgrade and reboot, disable strong passwords prior to
performing the upgrade. After the upgrade and reboot are complete, re-enable strong passwords.
Note the following:
●Passwords changes that are made between a software upgrade and subsequent reboot do not persist
through the reboot. The password expiration timer does not know if a password is changed during that
window, placing you at risk of a lockout.
●If all administrator account passwords expire, the unit must be returned to the factory.
Removing ETEPs From Service
To avoid having strong passwords expire during a planned service outage or equipment redeployment,
disable strong passwords prior to removing the ETEP from service.
If the password expiration and grace period is exceeded for all administrator accounts while the ETEP is
out of service, all users will be locked out and the ETEP must be returned to the factory.
Adding Users
At a minimum, adding a user involves creating a user name and associating a role with the name.
Additional parameters can be defined to provide enhanced security.
Basic user definition entails:
●Creating a unique user name
●Associating a role with the user name: admin or ops
Enhanced security features:
●If strong password enforcement is enabled, the Administrator specifies the password expiration,
expiration warning, minimum interval between password changes, and the maximum number of login
sessions.
●If you are using a Common Access Card (CAC) to provide user authorization in addition to
certificate-based authentication in an EncrypTight deployment, associate a common name with the
ETEP user. See the EncrypTight User Guide to learn how to enable this feature across the components
of your EncrypTight system.
NOTE
User accounts become active only after the Administrator assigns a password to the new user. See
“Assigning Passwords to Users” on page 27 to learn how.
Related topics:
●“Password Enforcement Options” on page 17
●“Creating a New User: Default Password Enforcement Policy” on page 22

Adding Users
ETEP CLI User Guide 21
●“Creating a New User: Strong Password Enforcement Policy” on page 23
●“Assigning Passwords to Users” on page 27
●“Enabling and Disabling Accounts” on page 29
Understanding User Roles
The user role determines how a user can access the appliance and what tasks the user can perform once
logged in. Users are assigned a role, user name, and password that allows them to access the functionality
of the appliance that is available to that role. The ETEP can track appliance events based on user name,
such as user account activity and policy deployments.
The ETEP has two roles: Administrator and Ops. The Administrator manages users, configures the
appliance, and creates and deploys policies. The Ops user has access to a limited set of commands for
initial appliance configuration, status reporting and diagnostics. Default user names are shown in Table 5.
The Administrator can manage the ETEP using the CLI or the EncrypTight software. The Ops user is
able to log in only to the CLI and has access to a limited set of commands. Table 6 provides a summary
of the tasks and privileges available to each role.
You must maintain at least one Administrator user account on the ETEP in order to manage the
appliance. You can add as many user accounts to the ETEP as you need. The ETEP does not impose a
cap on the number of user accounts that can be added.
Related topics:
●“Adding Users” on page 20
●“Assigning Passwords” on page 26
●“Viewing a List of Users” on page 26
Table 5 Default user names on the ETEP
Role Default user name
Administrator admin
Ops ops
Table 6 User role privileges
Function Administrator Ops
CLI access Yes Yes
EncrypTight access Yes No
Initial setup
(management port configuration and date)
Yes Yes
User management Yes No
Appliance configuration Yes No
Policy management Yes No
View audit logs Yes No
Show commands Yes Yes