Black Box ET0010A, Руководство пользователя CLI, Страница: 77 / 212

Creating Policies
78 ETEP CLI User Guide
●
When the ETEP is configured for Layer 2 point-to-point operation, the management port IKE server
is shut down, which prevents IKE SAs from being negotiated on the management port. Use manual
key policies to encrypt management port traffic when operating in this mode.
Task Overview
Securing a communication channel between the ETEP and another device requires you to perform
configuration tasks on the ETEP and on the other device. The procedures in this chapter describe how to
configure the management port policies on the ETEP. To learn how to use IPsec client software to create
companion polices and initiate connections to the ETEP, see the documentation for your IPsec client.
IPsec Client Task Summary
To secure management port communications through an IPsec tunnel you must have an IPsec client
installed on the management workstation or server that is providing the desired service. You can have
more than one device acting as a peer to the management port, for example a management station, NTP
server, or EncrypTight ETKMS.
After you have installed an IPsec client on the devices that will be communicating with the ETEP, you
will need to:
●
Configure IPsec policies on the ETEP management port (see “ETEP Task Summary” on page 78 )
●
Configure the IPsec client. See your IPsec client documentation to learn how to configure a
companion policy that will work with the ETEP settings.
●
From the IPsec client, initiate a secure connection to the ETEP.
ETEP Task Summary
Creating and deploying IPsec policies on the ETEP management port consists of the following high-level
tasks.
1 “Configuring Global Settings for IKE Negotiations” on page 79
IKE parameters define IKE SA (Phase 1) and IPsec SA (Phase 2) negotiation settings used in IKE
encryption policies. These are global settings that are applied to all IKE encryption policies that are
configured on the management port. Review the default settings and change them if you wish. These
settings apply only to IKE encryption policies. They are not used in discard, bypass, or manual key
policies.
2 “Policy Configuration” on page 82
Policies define which traffic to act on, the action to perform on the selected traffic (pass in the clear,
encrypt, or discard), and the endpoints of the IPSec tunnel. The ETEP supports IKE and manual key
encryption policies on the management port.
3 “Deploying Policies” on page 90
Pending policies become active on the ETEP only after you deploy them.