Black Box ET1000A, ET0010A manual IPSec, Addressing, Minimize Policy, Size, Network Sets, Protocol

Adding Layer 3 IP Policies

Table 48 Hub and spoke policy entries (continued)

Field	Description
IPSec	Specifies the encryption and authentication algorithms used in an IPSec policy.
	Select the encryption algorithm from the Encryption Algorithms list:
	• AES - Advanced Encryption Standard (default)
	• 3DES - a more secure variant of Data Encryption Standard
	Select the authentication algorithm from the Authentication Algorithms list:
	• HMAC-SHA-1- Secure Hash Algorithm
	• HMAC-MD5- Message Digest 5
	Note: Layer 4 policies require AES and HMAC-SHA-1.
Key Generation	Specifies the key generation and distribution mechanism for the PEPs included
	in the policy.
	• By Network Set - The default ETKMS within each network set generates
	and distributes the keys to the PEPs included in those network sets.
	• Global ETKMS - A global ETKMS generates the keys and sends them to
	the default ETKMSs in each network set for distribution to all of PEPs
	included in the policy.
	Select the desired ETKMS from the Global ETKMS list.
Addressing	Overrides the Network addressing setting for the network sets.
Mode Override	• Preserve internal network addresses - This setting overrides the network
	set’s network addressing mode and preserves the network addressing of the
	protected networks. The IP header contains the source address of the
	originating network.
	If this setting is disabled and the addressing mode of the network set uses
	the PEP’s remote IP address or a Virtual IP address, the IP header contains
	the source address as specified in the network set. If the addressing mode
	of the network set preserves the network IP address, disabling this setting
	has no effect.
	• Preserve address, protocol and port - This setting overrides the network
	set’s addressing mode and preserves the network addressing of the
	protected networks, as well as the specified protocol and port numbers. The
	IP header includes the source address, protocol, and port of the originating
	network. This allows you to send the Layer 4 header information in the clear
	for traffic engineering and Service Level Agreement (SLA) management (for
	example, Quality of Service controls).
Minimize Policy	Reduces policy size by ignoring the network addresses on the local port of the
Size	PEP. This reduces the amount of network traffic needed to renew keys and
	refresh policy lifetimes.
	• Minimize Policy Size (ignore source IP address) - This setting replaces
	the source network address for outbound traffic and the destination network
	address for inbound traffic with all networks wildcard addresses (0.0.0.0/0).
	For more information, see “Minimizing Policy Size” on page 187.
Network Sets	Identifies the network sets included in this policy.
	Click the Network Sets tab of the EncrypTight Components view and drag the
	appropriate network sets to either Hubs or Spokes.
Protocol	Specifies the Layer 3 protocol affected by this policy. The action selected for
	the policy is only applied to the traffic with the specified protocol.
	• Any - specifies all protocols
	• Only - specifies a particular protocol. Click to select and then enter the
	required protocol in the range 0 to 255.

EncrypTight User Guide 193