Black Box ET0010A, Руководство пользователя CLI

Страница: 82 / 212

Securing Management Port Traffic with IPsec
ETEP CLI User Guide 83
new policy. If you have two policies with non-consecutive priorities, such as 62000 and 59000, a new
policy will be assigned 61999. In many cases you will want to override the default priority
assignments to ensure that traffic is processed in the order in which you intend.
As you create policies, carefully consider the policy priority that you choose. Incorrect prioritization
can produce unexpected results. For example, policy A is a bypass policy for a specific destination
network for any protocol and has the highest priority. Policy B is a protect policy for the same
destination network with a particular protocol, but it has a lower priority. Because policy A has the
higher priority, all traffic passes in the clear and none of the traffic is encrypted.
It is a good practice to review the priorities of your policies prior to deploying them. Use the
show-
policy-set command to do this.
Related topics:
●
“Assigning Policy Names” on page 83
●
“Configuring an IKE Encryption Policy” on page 84
●
“Configuring a Manual Key Encryption Policy” on page 86
●
“Configuring a Bypass or Discard Policy on the Management Port” on page 89
●
“Backing Up the Policy Set” on page 91
●
“Modifying a Policy” on page 92
●
“Deploying Management Policies” on page 92
Assigning Policy Names
Before you can perform any policy configuration, you must add a policy “container” and give it a name.
The name is referenced in all subsequent policy configuration actions.
Policy names must conform to the following conventions:
●
Policy names can range from 1-32 characters.
●
Valid characters are upper and lower case alpha characters (a-z), numeric characters (0-9), _
(underscore), and - (dash).
●
Policy names must start with an alpha character or an underscore. The first character cannot be a
numeric digit or a dash.
●
Policy names cannot contain a space.
●
Names are case-sensitive.
To add a policy:
1 Enter ipsec configuration mode.
admin> configure
config>
management-interface
man-if> ipsec-config
ipsec-config>
2 Add a policy and assign it a name
policy-add <name>
3 Repeat step 2 for each management policy that you want to add to the ETEP.