Black Box ET0010A, Руководство пользователя CLI, Страница: 81 / 212

Creating Policies
82 ETEP CLI User Guide
Figure 14 show-ike-params command output
Policy Configuration
For any policy, you need to decide the following:
●
Policy name: uniquely identifies the policy on the ETEP.
●
Policy action: bypass, discard, or protect
●
Policy keying
For encryption policies, the ETEP supports IKE negotiated policies and manual keys policies on the
management port. IKE policies use the IKE parameters that are described in
“Configuring Global
Settings for IKE Negotiations” on page 79 . The keying method is automated, and keys are refreshed
at designated intervals. Manually keyed policies use keys that the user enters. These keys are static
and refreshed only when the policy is updated.
All management port encryption policies deployed on the ETEP must use the same keying method.
You cannot deploy a mix of IKE and manual key policies.
●
Policy selectors
IPsec selectors are essentially traffic filters. Management policies are usually granular policies that
filter traffic based on specific IP addresses, protocol types, or source and destination ports. The local
IP address selector is typically the ETEP’s management port IP address.
●
Policy priority
The policy priority specifies the order in which policies are processed on the ETEP. For each
incoming packet the ETEP searches through the list of policies, starting with the policy that has the
highest priority, until it finds a match. When it finds a match, the ETEP processes the packet
according to the settings in the policy.
When you add a new policy, the ETEP automatically assigns it a priority. To avoid duplicate policy
priorities, the ETEP decrements the priority by one from the highest priority it finds. For example, if
you have two policies with priorities of 65500 and 65499, the ETEP will assign priority 65498 to a
Protect policy In a protect policy, the ETEP encrypts the traffic that matches the policy
selectors. You can use IKE or manual keys to generate the keys for a protect
policy.
Bypass policy In a bypass policy, packets pass through the ETEP without security
processing being applied. Packets are passed in the clear and forwarded to
their destination. You might use a bypass policy to pass unencrypted
protocol-specific messaging packets such as ICMP or TLS, router-to-router
messages, or packets from certain types of applications.
Discard policy A discard policy instructs the ETEP to throw away specified packets. You
might use a discard policy to throw away packets from a particular source, or
any packets that don’t match your other policies.