Black Box ET0100A, ET1000A, ET0010A manual Layer 2 Ethernet Policy Using Vlan IDs, Setting PEP

Policy Design Examples

In ETEMS, configure the interfaces for both PEPs, then click the Features tab and do the following:

1Select Layer 2:Ethernet for the Encryption Policy Settings.

2Clear the Enable EncrypTight checkbox.

To set up the encryption policy between the two PEPs, click the Policy tab for each PEP and make the selections as described in Table 53. Make sure that you use the same key for both PEPs.

Table 53	Point-to-point Layer 2 encryption policy
Setting		PEP: 192.168.1.43	PEP: 192.168.1.44
Role		Primary	Secondary
IKE Authentication Method		PresharedKey	PresharedKey
IKE Preshared Key		zaq123edc	zaq123edc
Group ID		0	0
Traffic Handling		EthEncrypt	EthEncrypt

Once the PEP configurations have been saved, push the configuration to the remote PEP first, and then push the configuration to the local PEP. For more information about creating Layer 2 point-to-point policies, see the Configuration chapter for your PEPs.

Layer 2 Ethernet Policy Using VLAN IDs

This example shows a more complicated Layer 2 Ethernet policy encrypting traffic using specific VLAN IDs. Figure 83 shows a collection of networks for a company with a central headquarters and two branch offices. The company has a partner that needs access to specific company data, but does not need access to the branch offices.

Traffic between the headquarters and the branches is assigned a VLAN ID tag. This assures that communications between headquarters and the branches are not accidentally broadcast to other parties, such as the partner. Meanwhile, traffic between the partner and the partner portal server is assigned a different VLAN ID tag.

Finally, for added security all traffic not using one of the designated VLAN ID tags is discarded.

In this case, three separate policies need to be created:

●One Layer 2 Mesh encryption policy for traffic between the headquarters and each individual branch using VLAN ID 10

●One encryption policy for the traffic between the partner and partner portal server, using VLAN ID 20

●One drop policy that discards all traffic not using one of the specified VLAN ID tags, which is assigned a lower priority than the other policies

212 EncrypTight User Guide