Intel ETHEREXPRESS PRO/100 User manual

User’s Guide
IntelPRO/100Family
PacketProtect
Enabling the IPSec Protocol on
Microsoft Windows NT 4.0
®
®

Intel® Packet Protect User’s Guide
ii
Where to Go for More Information
Readme Files
For more information about installation and general information about
the product, see the readme text file. To view the files, view the root
folder on the Intel CD-ROM. Open readme.txt with any text editor.
Online Services
You can use the Internet to download software updates, and to view
troubleshooting tips, installation notes, and more. Online services are
on the World Wide Web at:
http://support.intel.com
Copyright © 2000, Intel Corporation. All rights reserved.
Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
Intel Corporation assumes no responsibility for errors or omissions in this document. Nor does Intel
make any commitment to update the information contained herein.
* Other product and corporate names may be trademarks of other companies and are used only for
explanation and to the owners’ benefit, without intent to infringe.

Contents
iii
Contents
Where to Go for More Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . ii
Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .iii
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
What is Intel Packet Protect? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
Packet Protect Features 2
Complete Your Security Solution 2
Hardware Acceleration 2
Domestic and Export Versions 2
Additional Information 3
How Packet Protect Works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
What is IP Security? 4
What is Internet Key Exchange? 4
The Process 5
Get Started . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Installing Packet Protect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Developing Your Deployment Model . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Review Your Network Architecture and
Corporate Security Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Assign security behavior roles to computers that you want to use
Packet Protect 9
Develop a strategy for handling pre-shared keys 10
Understand the Default Rule 11
Consider exceptions to the Default Rule 11
What are the Trade-offs? 12
Conclusion 14
Set Up Intel Adapters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Install Intel Adapters 15
Configure Intel Adapters 15
Install Packet Protect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
System Requirements 17
Licensing 17
Install Packet Protect 17
View Your Security Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Intel® Packet Protect User’s Guide
iv
Configuring Security Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Understand Default Security Behavior . . . . . . . . . . . . . . . . . . . . . . . . 22
Default Behaviors in Packet Protect 22
Set up Your System Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
What is a Policy? 25
What is a Rule? 25
The Default Rule 26
Importance of Rule Order 27
How Does the System Policy Work? 28
Add Rules to the System Policy 28
Making Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Modify the System Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Modify Destination Workgroups or Security Actions 41
Delete a Rule 41
Restore the System Policy 42
Monitor Packet Protect Computers . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
View Status at a Packet Protect Client 44
Set Up Compatible Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Work with Other Security Products . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Turn Security On for a Computer . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Install Security for a New Computer 47
Turn Security on Manually for an Existing Computer 47
Turn Security Off for a Computer . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Shut Down Packet Protect at a Computer 48
Uninstall Packet Protect from a Computer 48
Troubleshooting and FAQs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Frequently Asked Questions (FAQs) . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Appendix A — IKE and IPSec . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
IKE and IPSec Work Together . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
How Packet Protect Uses IKE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Identity Negotiation Settings 55
IPSec Settings 57

Contents
v
Examples 58
How Packet Protect Uses IPSec . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Security Associations 59
Security Association Lifetimes 59
How IPSec Protects Packets 60
Appendix B — Interoperability with Microsoft Windows* 2000 . 63
Interoperability with Windows* 2000 . . . . . . . . . . . . . . . . . . . . . . . . . 64
Appendix C — Network Software License Agreement . . . . . . . . . 65
Network Software License Agreement . . . . . . . . . . . . . . . . . . . . . . . . 66
Intel Automated Customer Support . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Readme Files on Your Product Disk 67
Web and Internet Sites 67
Customer Support Technicians 67
Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

Intel® Packet Protect User’s Guide
vi

1
1Introduction
With the growing amount of information that travels on your local area network
(LAN), confidential information has become a target for intruders both inside
and outside your company. These intruders may be employees, visitors to your
company, or a hacker who breaks through your firewall.
Intel® Packet Protect helps protect Internet Protocol (IP) traffic as it travels
between computers on your LAN. This protects confidential data from being
retrieved by intruders.
In this chapter, you’ll find information about:
• Packet Protect overview
• How Packet Protect works
• Getting started

Intel® Packet Protect User’s Guide
2
What is IntelPacket Protect?
Packet Protect is designed to protect the confidentiality and authenticity of IP
traffic on your LAN.
Packet Protect can assist you in creating a departmental solution for your secu-
rity concerns.
Many data compromises are attempted from within a company firewall. Unless
you protect information as it travels on the network, it can be received by
unwanted users.
For example, employees retrieving confidential designs from a Research &
Development department server use Packet Protect to encrypt the information
while it travels on the LAN. Encryption protects the confidentiality of the infor-
mation. Each employee’s computer can also verify the integrity of the informa-
tion upon receipt.
Packet Protect Features
Packet Protect enables you to:
• Protect confidentiality and authenticity of IP traffic on your LAN using
Internet Protocol Security (IPSec), including Internet Key Exchange (IKE).
• Offload security tasks to an IntelPRO/100 S Management or Server
Adapter to optimize network performance.
Complete Your Security Solution
If you need to protect data stored on a computer, use operating system features
combined with Packet Protect. Packet Protect protects data traveling between
computers, not while it’s stored on a computer. You should use your operating
system features or network infrastructure element to provide access control to
certain areas of the computers on the network.
Hardware Acceleration
Implementing an IPSecsolution can increase CPU utilization for computers that
use the IPSec software. This is common when implementing any IPSec solution
because of the intense computation required to encrypt, decrypt, and validate
packets. However, there is a way to offload security tasks from the CPU.
You can combine Packet Protect with the use of an Intel PRO/100 S Manage-
ment or ServerAdapter to reduce CPU utilization. This frees CPU utilization for
other tasks, while reducing the impact to network performance.
Domestic and Export Versions
Packet Protect is available in both domestic and export versions. The export ver-
sion supports DES (56-bit) encryption only. The domestic version, available in
the United States and Canada, supports DES and 3DES (168-bit) encryption.

Introduction
3
Additional Information
This Packet Protect User’s Guide in Adobe Acrobat* format can be found in the
Packet Protect directory on the product CD-ROM. Packet Protect help can be
found in the Help directory on the product CD-ROM.

Intel® Packet Protect User’s Guide
4
How Packet Protect Works
Packet Protect helps you protect network traffic that is sent from one server or
client to another. Packet Protect uses these steps to protect information traveling
on the network:
1. Activate IKE (Internet Key Exchange). Negotiates parameters for secure
communication.
2. Activate IPSec (Internet Protocol Security). Protects the communication
using the security parameters it negotiated successfully using IKE.
What is IP Security?
Internet Protocol (IP) Security (commonly called IPSec) is a set of standard pro-
tocols used to protect the confidentiality and authenticity of IP communications.
IPSec accomplishes this using the following:
• Encryption. Protects confidentiality of information traveling on the net-
work. Each packet is encrypted so that unwanted recipients can’t interpret
it. Packet Protect uses DES 56-bit and 3DES 168-bit encryption algorithms
(3DES in U.S. and Canada version only).
•Integrity.Protects the authenticity of the information traveling on the net-
work by verifying that each packet was unchanged in transport. Packet Pro-
tect uses MD5 and SHA-1 authentication algorithms for both ESP and AH
authentication.
• Anti-replay protection. Protects the network by preventing an intruder
from successfully repeatedly sending an identical packet in an attempt to
confuse the system.
For more information about IPSec, see “Appendix A — IKE and IPSec” on
page 53.
What is Internet Key Exchange?
Internet Key Exchange (IKE) is a standard protocol used to negotiate a protected
communication. Negotiation is the first phase in setting up a secure communica-
tion. IKE verifies the identity of the computers using pre-shared keys. Then it
negotiates a set of security settings to protect the communication.
IKE is a protocol that operates inside a framework defined by ISAKMP (Internet
Security Association Key Management Protocol) and is used to support the
establishment of Security Associations.
For more information about IKE, see “Appendix A — IKE and IPSec” on
page 53.

Introduction
5
The Process
If two computers require security, each time they attempt to communicate with
each other Packet Protect follows these steps to attempt a protected communica-
tion:
1. Each computer uses IKE to verify thatthe other is the computer it claims to
be.
2. If identity verification is successful in Step 1, the two computers use IKE to
agree upon the IPSec settings to use.
3. If the agreement is successful in Step 2, both computers will use the agreed
upon IPSec settings to protect the data as it travels.
As long as the protected communication is active, the two computers can
exchange information, without repeating Steps 1 and 2 (up to the pre-defined
time and size limits — see Table 6 on page 34 for more information).
The following diagram shows the roles of IKE and IPSec.
Step 1: IKE Verifies Pre-shared Key
Step 2: IKE Negotiates IPSec Settings
Step 3: IPSec Protects the Communication

Intel® Packet Protect User’s Guide
6
Get Started
To start using Packet Protect
1. Evaluate your network architecture and decide which areas require Packet
Protect. For details, see “Developing Your Deployment Model” on page 8.
2. Install Packet Protect on those computers that require security. For details,
see “Install Packet Protect” on page 17.
3. Set up security settings for each computer where you installed Packet Pro-
tect. For details, see Chapter 3, “Configuring Security Settings” on
page 21.

7
2Installing Packet Protect
To set up your network in preparation for deploying security, there are several
things to consider. This chapter guides you through the setup process so you can
begin deploying security most effectively.
In this chapter, you’ll find information about:
• Developing your deployment model.
• Setting up Intelnetwork adapters.
• Installing Packet Protect.

Intel® Packet Protect User’s Guide
8
Developing Your Deployment Model
In order to use Packet Protect successfully, you must develop a deployment
model that fulfills your security needs on your network. There are several stages
to consider in developing your deployment model.
• Review your network architecture and corporate security guidelines.
• Assign security behavior roles to computers that you want to use Packet
Protect.
• Develop a strategy for using pre-shared keys.
• Understand the Default Rule.
• Consider exceptions to the Default Rule.
This discussion represents only an overview of some of the issues that should be
considered when deploying Packet Protect in your enterprise. For more detailed
information about deployment models, please refer to “Scalable Deployment of
IPSec in Corporate Intranets”white paper from the Intel Architecture Labs Inter-
net Building Blocks Initiative. This white paper can be found at:
ftp://download.intel.com/ial/home/ibbi/ipsec_122.pdf
Review Your Network Architecture and
Corporate Security Guidelines
The amount of confidential information traveling on your network grows as
more employees use your corporate network. This poses a security risk if some-
one breaks through your firewall, or someone already behind your firewall has
access to the network—those people can access confidential information. For
example, an intruder can mimic an IP address and receive information that was
intended for someone else at that IP address. Or, an intruder can use software to
view data as it travels on your LAN.
You can deploy Packet Protect in the areas of your network that transmit sensi-
tive information. Some areas of your network might require the additional pro-
tection provided by Packet Protect, while other areas might not. Use your
corporate security guidelines to help determine which areas of your network
require Packet Protect.
Perhaps you have a server that stores highly confidential information, such as
corporate financial figures or e-commerce transactions. You can use your oper-
ating system’s tools to help protect data stored on the server’s hard disk, but
what about when other computers access that information? Use Packet Protect

Installing Packet Protect
9
to protect your highly confidential information as it travels to and from the
server.
Assign security behavior roles to computers that you want to use
Packet Protect
Packet Protect uses default security behavior to determine how a computer will
communicate with other computers on the network. There are three default
behaviors: Secure Responder, Secure Initiator and Lockdown.
Secure Responder
A computer with the default behavior of Secure Responder always initiates and
accepts traffic that is not secured. However, it will accept a secure communica-
tion if it is initiated by another computer. Of course, the negotiation will succeed
only if one the proposals in the list offered by the initiator can be matched by the
responder.
Secure Responder is a likely behavior for the majority of workstations in a net-
work. Communications will always be allowed in the clear between computers
that are Secure Responders or Secure Initiators, but will communicate securely
with a computer (usually a server) with Lockdown default behavior.
Secure Initiator
A computer with the default behavior of Secure Initiator will always attempt to
initiate secure communications on all outbound traffic. Even if an inbound com-
munication flow is initiated in the clear, the response data flow will cause the
computer to initiate a secure session. However, if a secure session cannot be ini-
tiated, the computers will fallback to communicating in the clear.
Secure Initiator behavior is appropriate for both workstations and servers. Com-
puters who wish to use peer-to-peer secure communications can use Secure Ini-

Intel® Packet Protect User’s Guide
10
tiator behavior. Also, many servers can use this behavior as well, as long as the
fallback behavior is acceptable for your network.
Secure Initiator is similar to Secure Responder, except that all outbound traffic
will result in an attempt to negotiate parameters for security.
Lockdown
A computer with Lockdown behavior will always initiate and respond securely
to all data flows. If the negotiation fails on either computer, then traffic will be
denied.
Lockdown behavior is used for servers with high content value, as it requires
security for all data transmissions.
Communicating with non-Packet Protect computers
It is common to not use Packet Protect on all the computers in your network.
While the security that Packet Protect can provide is beneficial, there are several
reasons to limit the computers on your network that use Packet Protect, such as:
• Only a limited number of computers on your network require secure com-
munications.
• In order to minimize CPU utilization, you want to limit use of Packet Pro-
tect to computers that already have PRO/100S Management or Server
adapters.
Computers that use the default behavior of Secure Responder or Secure Initiator
will always be able to communicate in the clear with computers in your network
that do not use Packet Protect.
Computers that use the default behavior of Lockdown will not be able to com-
municate with computers in your network that do not use Packet Protect.
Develop a strategy for handling pre-shared keys
When two computers attempt secure communication, they negotiate parameters
for the communication. In addition to using their default behavior, described in
the previous section, they also exchange a string of characters known as a pre-
shared key.
When the computers begin to negotiate parameters, they compare their pre-
shared keys. If both computers have the same pre-shared key, then the computers
will go ahead and negotiate parameters for the session. If the computers have a
different pre-shared key, then the negotiation for secure communication will
cease.
Once the pre-shared keys have been compared and matched between the two
computers, the IKE protocol generates secure, secret session keys. No one can
find out what these session keys are, even if they know what the pre-shared key
is. Although pre-shared keys are sometimes called passwords, they do not act
like passwords. Even whenyou know what the pre-shared key is, you cannot use
that key to intercept or decrypt the information that is being transmitted.

Installing Packet Protect
11
Sharing keys
It’s important when you are developing your deployment model that you decide
how to handle the distribution of the pre-shared key. Some networks use a
widely-published key, known as a “group key” or the “pre-shared key on the
wall.” In this strategy, you make the pre-shared available to everyone. This way,
all computers will be configured to use the same key. This ensures that when
secure communications are requested, then IKE will be able to negotiate secure
communications when the keys are matched between two computers.
In addition to “group key,” some enterprises may want to use additional, more
private pre-shared keys in certain instances. For example, the president and the
chief financial officer of a corporation may wish to send secured transmissions
to each other. In this instance, each of these computers would use the group key
as part of their standard System Policy, but would create a special rule to cover
communications just between them. (See “Consider exceptions to the Default
Rule” for more information on implementing this scenario.) In this case, they
might likely choose a more secret pre-shared key that just the two computers use
with each other.
Understand the Default Rule
Every computer that uses Packet Protect has a single System Policy. Each Sys-
tem Policy initially contains a single Default Rule. The Default Rule is quite
simple:
For Everybody, use the Default Security Action. If the rule fails, Allow
Communication without Security.
Note: For computers that use the Lockdown behavior wth the
Default Rule, if the rule fails then
Deny Communication
is the
fallback action.
See “The Default Rule” on page 26 for more information.
Note: If you want to have secure communication between a Packet
Protect computer and a Windows 2000* computer, you must
use the Default Rule. Intel recommends that you do not
delete the Default Rule.
See “What is a Rule?” on page 25 for more information about rules in Packet
Protect.
Consider exceptions to the Default Rule
Many enterprises may find that by careful consideration of the default behavior
roles, a widely published pre-shared key, and the Default Rule, they can meet
their security requirements without extra effort. This model is quite workable
and provides adequate security. It is also simple to deploy and maintain.

Intel® Packet Protect User’s Guide
12
Some enterprises may wish to create additional rules that govern communica-
tions between two specific computers.
Earlier, we introduced a scenario where the president and chief financial officer
of a company wished to implement extra security for their communications. For
this scenario, a new rule is needed. Let’s compare a possible rule for this sce-
nario to the System Policy’s Default Rule:
In addition to these rules, both the president and the Chief Financial Officer
would havethe Secure Initiator default behavior. Therule might also want to use
more secure options, such as perfect forward secrecy, which provides a very
secure negotiation of session keys. There are many other security options that
can be chosen when you create a security action for this rule. See “Customize
Security Actions” on page 33 for more information on options for security
actions.
By comparing the new rule and the default rule, you can see how the new rule
provides an extra measure of security. The new security action is much more
limited. Longer time and/or size limits on a security action can give an intruder
an opportunity to intercept and possibly corrupt packets. By denying communi-
cation in case of rule failure, you ensure that communication between these two
computers will never occur in the clear.
What are the Trade-offs?
A very important part of developing your deployment model is to consider not
only the initial deployment, but maintaining the System Policies on all the com-
puters that use Packet Protect in your network.
Clearly, the simplest model we discussed will be the easiest to deploy and main-
tain. When all computers use the same defaults—Default Rule, security action,
Table 1: Rule Comparison
Property New Rule Default Rule
Destination
Workgroup President and CFO only Everybody
Security Action New Security Action: Up
to 15 minutes or 50 MB,
whichever occurs first.
Then, a new security
association is negotiated.
Default Security Action:
Up to8 hours, thena new
security association is
negotiated.
Rule Failure Deny Communication. Allow communication in
the clear.
Authentication Use a new pre-shared
key, known only to these
two computers.
Use the System Policy’s
settings

Installing Packet Protect
13
fallback to clear communication, same pre-shared key—then you’ll be able to
gain adequate security with minimum impact to your network.
If you decide on a more complex deployment model, you should consider the
benefits of the extra security that you have against the costs of maintaining and
running the model. There are two areas that you should evaluate—maintenance
and CPU utilization.
Maintenance
If you are considering a deployment model with many customizations and spe-
cialized rules, be aware of the time and effort required for ongoing maintenance.
Because each computer with Packet Protect must be configured individually,
customizations require more effort to keep each computer up-to-date.
Let’s consider the previous example of the special rule for the president and
Chief Financial Officer of the corporation. In order for this rule to work as
designed, all aspects of the rule must match, or communication will be denied. If
the president’s computer uses a different setting in the security action from the
CFO’s computer, then a security association cannot be negotiated and therefore
all communication is denied. Consider then that it might take several days for
the president and CFO to even discover that their communications haven’t been
taking place, as assumed.
Even a new computer for the president could prevent secure communication
from happening. For example, when you set up this special rule, you identified
the two computers to Packet Protect by the names of the computers. The presi-
dent’s new computer has a new name. When the president and the CFO attempt
to communicate the next time, the rule will fail, because of the computer name.
You can imagine how difficult it can become to maintain specialized rules, desti-
nation workgroups, and security actions in your network. Intel recommends that
you begin by using the simple, default model for secure communications. Over
time, you may consider customizations to enhance secure communications in
special cases.
CPU Utilization
Another veryimportant factor to consider is the effect of IPSec on your network,
as well as the individual computers using Packet Protect. Generally, you can
assume that when you choose most sophisticated security options, there will be
impact on your network.
One example is choosing to use ESP (Encapsulation Security Payload) and AH
(Authentication Header) authentication together. While thiscombination affords
extra protection, you must consider that when you use both of these methods,
you cannot offload any processing to the adapter, and thus CPU utilization
increases. However, if you use just ESP authentication with the appropriate
adapter, you can take advantage of the hardware offload and get better CPU util-
itzation.
You must also consider the adapters that are installed in your Packet Protect
computers. Only the Intel PRO/100 S Server Adapter and Intel PRO/100 S Man-

Intel® Packet Protect User’s Guide
14
agement Adapter can perform hardware offloading. If you have other Intel PRO/
100 Adapters in Packet Protect computers, you won’t be able to offload any pro-
cessing, thus increasing CPU utilization and potentially slowing that computer’s
network performance.
Other security options are considered “costly” as well. Perfect Forward Secrecy
is very secure, but if used widely throughout the network, there can be a signifi-
cant effect on servers that have a lot of secure traffic.
Conclusion
Hopefully, this section provided some guidelines for you to consider as you
develop your deployment model. There are no hard-and-fast rules that you must
follow. However, Intel recommends that you begin your use of IPSec and Packet
Protect slowly in your enterprise. You should consider starting with a small
group that use the same pre-shared key and default System Policy. When you’ve
had a chance to evaluate this first implementation phase, you can then decide
how to expand your use of Packet Protect.