Black Box ET0010A, Руководство пользователя CLI, Страница: 64 / 212

Creating Local Site Policies
ETEP CLI User Guide 65
You can use the local-site CLI commands to create a variety of policies:
●
Pass Layer 3 routing protocols in the clear when encrypting traffic at Layer 2
●
Encrypt in-line management traffic that is typically passed in the clear when deploying EncrypTight
policies, such as TLS and ARP packets
●
Create manual key encryption policies for Layer 2 or Layer 3 traffic
●
Create discard policies based on Layer 2 selectors (Ethertype or VLAN ID) or Layer 3 selectors
Local site policies cannot be created or deployed when the ETEP is configured for Layer 2 stand-alone
operation, as described in
“Creating Layer 2 Point-to-Point Policies” on page 57 .
Related topics:
●
“Policy Configuration” on page 65
●
“Configuring a Local Site Bypass or Discard Policy” on page 67
●
“Configuring a Local Site Encryption Policy” on page 69
●
“policy-mode” on page 176
Policy Configuration
For any policy, you need to decide the following:
●
Policy name: uniquely identifies the policy on the ETEP.
●
Policy action: bypass, discard, or protect
●
Policy selectors
Policy selectors are essentially traffic filters. The ETEP has Layer 2 filters and Layer 3 filters.
Layer 2 selectors let you filter traffic based on Ethertype or VLAN ID.
At Layer 3, policies can be configured with fairly coarse traffic filters, allowing access to an entire
subnet or to all destinations (0.0.0.0/0). Or, you can create more granular policies using selectors
based on IP subnets, partial subnets, individual destinations, protocol types, or source and destination
ports.
Unlike distributed key policies, local-site policies associate a single selector with a given policy and
manual key combination.
●
Policy priority
The policy priority specifies the order in which policies are processed on the ETEP. For each
incoming packet the ETEP searches through the list of policies, starting with the policy that has the
highest priority, until it finds a match. When it finds a match, the ETEP processes the packet
according to the settings in the policy.
Bypass policy In a bypass policy, packets pass through the ETEP without encryption being
applied. You might use a bypass policy to pass unencrypted protocol-specific
messaging packets such as ICMP or TLS, router-to-router messages, or
packets from certain types of applications.
Protect policy In a protect policy, the ETEP encrypts the traffic that matches the policy
selectors using a user-defined manual key.
Discard policy A discard policy instructs the ETEP to throw away specified packets. You
might use a discard policy to throw away packets from a particular source.