Black Box ET0010A Policy Priority, Schedule for Renewing Keys and Refreshing Policy Lifetime

Creating Distributed Key Policies

●“Key Generation and ETKMSs” on page 185

●“Addressing Mode” on page 185

●“Using Encrypt All Policies with Exceptions” on page 185

●“Policy Size and ETEP Operational Limits” on page 186

●“Minimizing Policy Size” on page 187

Policy Priority

You can assign a priority from 1 to 65000 to each policy that you create. The policy priority specifies the order in which policies are processed on the PEP. For each incoming packet or frame the PEP searches through the list of policies, starting with the policy that has the highest priority, until it finds a match. When it finds a match, the PEP processes the packet or frame according to the settings in the policy. As you create policies, carefully consider the policy priority that you choose.

If your policies are not being implemented as expected, check the priorities assigned to the policies. Incorrect prioritization can produce unexpected results. For example, policy A is a clear policy for a specific destination network for any protocol and has the highest priority. Policy B is an encrypt policy for the same destination network with a particular protocol, but it has a lower priority. Because policy A has the higher priority, all traffic passes and none of the traffic is encrypted.

Schedule for Renewing Keys and Refreshing Policy Lifetime

The Renew keys/Refresh lifetime value specifies the length of time that the keys and policies will be active. According to the schedule specified in the policy, the ETKMS sends new keys to the PEPs. The previous keys are maintained on the PEP for up to five minutes to ensure that no traffic interruption occurs. For Bypass and Drop policies (which do not have keys), the policy lifetimes are refreshed.

You schedule the key renewal and policy refresh in an interval of hours or set a daily renewal at a specified time.

●Hours - enter the re-key interval in hours between 0 and 65535 hours. Use 0 to effectively specify that the keys and policies never expire and never update. (Technically, when you enter 0, ETPM inserts the value of 61320 hours, or 7 years.) Most likely, you will only use 0 hours for drop and clear policy types.

●Daily - enter the re-key time using the 24 hour system clock set to the required local time of the ETPM workstation. The re-key time will translate to the local times of the ETKMSs and PEPs that might be located in other time zones.

TIP

Management traffic increases during the policy rekey and renew lifetime process. This is true for both manual and automatic rekeys. If you schedule all policies to rekey at the same time, the ETKMSs will send new keys to all of their PEPs at the same time, causing an increase in traffic throughout your network. You can reduce the traffic and processing time by staggering the rekey schedule specified for each policy. For example, one policy could be set to rekey at 1:00 AM while another policy could be set to rekey at 1:30 AM. This significantly reduces the management traffic and PEP processing time.

182 EncrypTight User Guide