Black Box ET0010A, Руководство пользователя CLI, Страница: 11 / 212

Getting Started
12 ETEP CLI User Guide
The ETEP interfaces with network equipment through two data ports, the local port and the remote port.
Unencrypted traffic that originates from a trusted, local network is received on the local port, where the
ETEP applies security processing to it. The encrypted traffic is then sent from the remote port to an
untrusted network such as the Internet. At the opposite endpoint the process is reversed. Encrypted traffic
is received on the ETEP remote port and decrypted. Then the decrypted traffic is sent from the local port
to the destination.
The ETEP is managed in-line or out-of-band through a dedicated Ethernet management interface.
Managing the ETEP
The ETEP can be managed in two ways, depending on the size and complexity of your deployment.
Several options are available for securing management traffic based on the management option that you
choose.
●
Command Line Interface (CLI)
CLI commands are available to perform initial setup of the ETEP, along with diagnostic and
troubleshooting commands. In point-to-point deployments, you can configure the ETEPs for operation
and create policies using the CLI commands.
●
EncrypTight Policy and Key Manager™
EncrypTight separates the functions of policy management, key generation and distribution, and
policy enforcement. As a result, multiple ETEPs can use common keys. This works for complex
mesh, hub and spoke, and multicast networks, as well as in straightforward point-to-point topologies.
EncrypTight includes the following components:
●
ETEMS for appliance configuration and management
●
ETPM for policy definition and deployment
●
ETKMS for key generation and distribution
This manual describes how to configure, manage, and troubleshoot the ETEP using the command line
interface. If you are using EncrypTight to manage your ETEPs, see the documentation for that product to
learn how to configure appliances and deploy policies.
CLI sessions can be secured in three ways:
●
Attach a PC directly to the serial port
●
Use any SSH client for a secure remote connection through the Ethernet management port.
If you wish to limit remote access to the ETEP after it has been put into service, you can disable SSH
(see
“ssh-enable” on page 192 ).
●
Use IPsec to secure the management port traffic
Most management port communications are secured using SSH and TLS. If you wish, you can create
IPsec policies on the management port to provide security for traffic that is not protected by SSH and
TLS, such as FTP traffic, SNMP traffic, and the NTP protocol. To learn how to create IPsec policies
on the management interface, see
“Securing Management Port Traffic with IPsec” on page 77 .