Intel ETHEREXPRESS PRO/100 User manual

User’s Guide
IntelPRO/100Family
PacketProtect
Enabling the IPSec Protocol on
Microsoft Windows NT 4.0
®
®

Intel® Packet Protect User’s Guide
ii
Where to Go for More Information
Readme Files
For more information about installation and general information about
the product, see the readme text file. To view the files, view the root
folder on the Intel CD-ROM. Open readme.txt with any text editor.
Online Services
You can use the Internet to download software updates, and to view
troubleshooting tips, installation notes, and more. Online services are
on the World Wide Web at:
http://support.intel.com
Copyright © 2000, Intel Corporation. All rights reserved.
Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
Intel Corporation assumes no responsibility for errors or omissions in this document. Nor does Intel
make any commitment to update the information contained herein.
* Other product and corporate names may be trademarks of other companies and are used only for
explanation and to the owners’ benefit, without intent to infringe.

Contents
iii
Contents
Where to Go for More Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . ii
Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .iii
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
What is Intel Packet Protect? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
Packet Protect Features 2
Complete Your Security Solution 2
Hardware Acceleration 2
Domestic and Export Versions 2
Additional Information 3
How Packet Protect Works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
What is IP Security? 4
What is Internet Key Exchange? 4
The Process 5
Get Started . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Installing Packet Protect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Developing Your Deployment Model . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Review Your Network Architecture and
Corporate Security Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Assign security behavior roles to computers that you want to use
Packet Protect 9
Develop a strategy for handling pre-shared keys 10
Understand the Default Rule 11
Consider exceptions to the Default Rule 11
What are the Trade-offs? 12
Conclusion 14
Set Up Intel Adapters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Install Intel Adapters 15
Configure Intel Adapters 15
Install Packet Protect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
System Requirements 17
Licensing 17
Install Packet Protect 17
View Your Security Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Intel® Packet Protect User’s Guide
iv
Configuring Security Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Understand Default Security Behavior . . . . . . . . . . . . . . . . . . . . . . . . 22
Default Behaviors in Packet Protect 22
Set up Your System Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
What is a Policy? 25
What is a Rule? 25
The Default Rule 26
Importance of Rule Order 27
How Does the System Policy Work? 28
Add Rules to the System Policy 28
Making Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Modify the System Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Modify Destination Workgroups or Security Actions 41
Delete a Rule 41
Restore the System Policy 42
Monitor Packet Protect Computers . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
View Status at a Packet Protect Client 44
Set Up Compatible Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Work with Other Security Products . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Turn Security On for a Computer . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Install Security for a New Computer 47
Turn Security on Manually for an Existing Computer 47
Turn Security Off for a Computer . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Shut Down Packet Protect at a Computer 48
Uninstall Packet Protect from a Computer 48
Troubleshooting and FAQs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Frequently Asked Questions (FAQs) . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Appendix A — IKE and IPSec . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
IKE and IPSec Work Together . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
How Packet Protect Uses IKE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Identity Negotiation Settings 55
IPSec Settings 57

Contents
v
Examples 58
How Packet Protect Uses IPSec . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Security Associations 59
Security Association Lifetimes 59
How IPSec Protects Packets 60
Appendix B — Interoperability with Microsoft Windows* 2000 . 63
Interoperability with Windows* 2000 . . . . . . . . . . . . . . . . . . . . . . . . . 64
Appendix C — Network Software License Agreement . . . . . . . . . 65
Network Software License Agreement . . . . . . . . . . . . . . . . . . . . . . . . 66
Intel Automated Customer Support . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Readme Files on Your Product Disk 67
Web and Internet Sites 67
Customer Support Technicians 67
Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

Intel® Packet Protect User’s Guide
vi

1
1Introduction
With the growing amount of information that travels on your local area network
(LAN), confidential information has become a target for intruders both inside
and outside your company. These intruders may be employees, visitors to your
company, or a hacker who breaks through your firewall.
Intel® Packet Protect helps protect Internet Protocol (IP) traffic as it travels
between computers on your LAN. This protects confidential data from being
retrieved by intruders.
In this chapter, you’ll find information about:
• Packet Protect overview
• How Packet Protect works
• Getting started

Intel® Packet Protect User’s Guide
2
What is IntelPacket Protect?
Packet Protect is designed to protect the confidentiality and authenticity of IP
traffic on your LAN.
Packet Protect can assist you in creating a departmental solution for your secu-
rity concerns.
Many data compromises are attempted from within a company firewall. Unless
you protect information as it travels on the network, it can be received by
unwanted users.
For example, employees retrieving confidential designs from a Research &
Development department server use Packet Protect to encrypt the information
while it travels on the LAN. Encryption protects the confidentiality of the infor-
mation. Each employee’s computer can also verify the integrity of the informa-
tion upon receipt.
Packet Protect Features
Packet Protect enables you to:
• Protect confidentiality and authenticity of IP traffic on your LAN using
Internet Protocol Security (IPSec), including Internet Key Exchange (IKE).
• Offload security tasks to an IntelPRO/100 S Management or Server
Adapter to optimize network performance.
Complete Your Security Solution
If you need to protect data stored on a computer, use operating system features
combined with Packet Protect. Packet Protect protects data traveling between
computers, not while it’s stored on a computer. You should use your operating
system features or network infrastructure element to provide access control to
certain areas of the computers on the network.
Hardware Acceleration
Implementing an IPSecsolution can increase CPU utilization for computers that
use the IPSec software. This is common when implementing any IPSec solution
because of the intense computation required to encrypt, decrypt, and validate
packets. However, there is a way to offload security tasks from the CPU.
You can combine Packet Protect with the use of an Intel PRO/100 S Manage-
ment or ServerAdapter to reduce CPU utilization. This frees CPU utilization for
other tasks, while reducing the impact to network performance.
Domestic and Export Versions
Packet Protect is available in both domestic and export versions. The export ver-
sion supports DES (56-bit) encryption only. The domestic version, available in
the United States and Canada, supports DES and 3DES (168-bit) encryption.

Introduction
3
Additional Information
This Packet Protect User’s Guide in Adobe Acrobat* format can be found in the
Packet Protect directory on the product CD-ROM. Packet Protect help can be
found in the Help directory on the product CD-ROM.

Intel® Packet Protect User’s Guide
4
How Packet Protect Works
Packet Protect helps you protect network traffic that is sent from one server or
client to another. Packet Protect uses these steps to protect information traveling
on the network:
1. Activate IKE (Internet Key Exchange). Negotiates parameters for secure
communication.
2. Activate IPSec (Internet Protocol Security). Protects the communication
using the security parameters it negotiated successfully using IKE.
What is IP Security?
Internet Protocol (IP) Security (commonly called IPSec) is a set of standard pro-
tocols used to protect the confidentiality and authenticity of IP communications.
IPSec accomplishes this using the following:
• Encryption. Protects confidentiality of information traveling on the net-
work. Each packet is encrypted so that unwanted recipients can’t interpret
it. Packet Protect uses DES 56-bit and 3DES 168-bit encryption algorithms
(3DES in U.S. and Canada version only).
•Integrity.Protects the authenticity of the information traveling on the net-
work by verifying that each packet was unchanged in transport. Packet Pro-
tect uses MD5 and SHA-1 authentication algorithms for both ESP and AH
authentication.
• Anti-replay protection. Protects the network by preventing an intruder
from successfully repeatedly sending an identical packet in an attempt to
confuse the system.
For more information about IPSec, see “Appendix A — IKE and IPSec” on
page 53.
What is Internet Key Exchange?
Internet Key Exchange (IKE) is a standard protocol used to negotiate a protected
communication. Negotiation is the first phase in setting up a secure communica-
tion. IKE verifies the identity of the computers using pre-shared keys. Then it
negotiates a set of security settings to protect the communication.
IKE is a protocol that operates inside a framework defined by ISAKMP (Internet
Security Association Key Management Protocol) and is used to support the
establishment of Security Associations.
For more information about IKE, see “Appendix A — IKE and IPSec” on
page 53.