Black Box ET0010A, Cli User Manual

Page: 176 / 212

Commands
ETEP CLI User Guide 177
Usage Guidelines
The policy setting determines whether the ETEP can be used in Layer 2 Ethernet or Layer 3 IP policies.
ETEPs that are configured for Layer 2 cannot be used in Layer 3 policies and vice versa. If you intend to
create a Layer 4 policy to encrypt only the packet payload, set the policy setting to Layer 3.
The EncrypTight setting defines whether or not EncrypTight is used for policy management. To deploy
Layer 2 IKE policies, set enable-CE to false. For distributed key polices, the enable-CE attribute must be
set to true.
Passing TLS-based management traffic in the clear is required for EncrypTight distributed key policies,
and when the ETEP is managed in-line. When the ETEP is operating in Layer 2 distributed key mode,
ARP traffic is also passed in the clear when tls-clear is set to true. When the ETEP is operating in Layer
2 point-to-point mode, the tls-clear setting is false.
When you change the policy-mode of an in-service ETEP, all encrypt and drop policies currently
installed on the ETEP are removed. Traffic is sent in the clear until you create and deploy new policies.
Example
The first example configures the ETEP for Layer 2 operation. It will be used in a Layer 2 point-to-point
policy, so EncrypTight is disabled. In Layer 2 point-to-point policies, the tls-clear attribute is always set
to false.
config> policies
policies> policy-mode layer2 false false
The next example configures the ETEP for Layer 3 operation in a distributed key environment, in which
EncrypTight is used for policy management. TLS traffic will pass in the clear.
config> policies
policies>
policy-mode layer3 true true
policy-packet-count
Description
The
policy-packet-count
command provides a mechanism for tracking packets through multiple
ETEPs. This can help you determine why certain packets are being dropped in your network. When the
packet counters are enabled, you can compare packet counts between the sending and receiving ETEPs to
help pinpoint the source of the problem.
User Type
Administrator
Hierarchy Level
Policies mode (config > policies)
Syntax
policy-packet-count {enable | disable}