EncrypTight User Guide
Table of Contents
Managing EncrypTight Users
Provisioning Appliances
Getting Started with Etems
Managing Appliances 117
Creating Vlan ID Ranges for Layer 2 Networks
Managing Key Management Systems
Managing IP Networks
Managing Network Sets
Policy Design Examples 211
Modifying the Etkms Properties File
Using Enhanced Security Features
Etep Configuration 299
302
Index 343
About This Document
Preface
Contacting Black Box Technical Support
Part I EncrypTight Installation and Maintenance
EncrypTight User Guide
Distributed Key Topologies
EncrypTight Overview
Layer 2 Ethernet topologies
Network topologies
Topology Description
Layer 3 IP topologies
Related topics
EncrypTight Elements
Key Management System
EncrypTight Element Management System
Policy Manager
Single Etkms for multiple sites
Policy Enforcement Point
Shared keys
Point-to-Point Negotiated Topology
Layer 2 Point-to-Point Deployment
Security within EncrypTight
Secure Key Storage within the Etkms
Secure Communications Between Devices
EncrypTight Component Connections
EncrypTight Deployment Planning
Etpm to Etkms Connections
Management Station Connections
Etpm and Etkms in Layer 3 IP Policies
Etpm and Etkms on the Same Subnetwork
Etpm and Etkms on Different Subnetworks
Out-of-band Etkms management in an Ethernet network
External Etkms to Etkms Connections
Connections for Backup ETKMSs
Etkms to Etkms Connections in Ethernet Networks
Connecting Multiple ETKMSs in an IP Network
Etkms to PEP Connections in IP Networks
Etkms to PEP Connections
In-line Etkms to PEP communications in IP networks
Etkms to PEP Connections in Ethernet Networks
IPv6 Address Support
Network Clock Synchronization
Address Format Address Representation
Certificate Support
IPv6 address representations
Addressing Method Description
Network Addressing for IP Networks
Network Addressing Options
Related topics
Before You Start
Installation and Configuration
Third party management station software
Hardware Requirements
Software Requirements
EncrypTight management station requirements
Firewall Ports
EncrypTight Software Installation
Installing EncrypTight Software for the First Time
To install the EncrypTight software
Starting EncrypTight
Uninstalling EncrypTight Software
To uninstall EncrypTight
Upgrading to a New Version of EncrypTight
Related topic
Management Station Configuration
Exiting EncrypTight
To start Etems
Etems communications options
To enable the Microsoft FTP Server service
Securing the Management Interface
Enabling the Microsoft FTP Server
Etkms server connections
Installing ETKMSs
Configuring ETKMSs
Configuring the Syslog Server
Adding a Local Etkms
Basic Configuration for Local ETKMSs
About Local ETKMSs
To launch a local Etkms
Launching and Stopping a Local Etkms
Starting the Local Etkms Automatically
To add a local Etkms
Maintaining the start.bat file
Configuring External ETKMSs
Prior to configuring the batch file do the following
To configure the batch file
To log into the Etkms
Changing the Admin Password
To change the admin password
Logging Into the Etkms
To change the root password
Changing the Root Password
IPv4
Configure the Network Connection
To configure the network connection and hostname
Static IP Netmask Default Gateway IP address
IPv6
To configure the network interface
To set the hostname and IPv6 default gateway address
To set the default DNS server and configure the hosts file
To set the time zone
Configure Time and Date Properties
To set up time synchronization
Field Description
Ntpq -p command output
To restart the NTP daemon
To check the time source connection status
Check the Status of the Hardware Security Module
Starting and Stopping the Etkms Service
Checking the Status of the Etkms
Configuring Syslog Reporting on the ETKMSs
To check the status of the Etkms service
To configure syslog reporting on a Etkms
Policy Enforcement Point Configuration
Etep Throughput Speeds
Default User Accounts and Passwords
Passwords to change
Managing Licenses
Choose Tools Put License
Installing Licenses
To install a license on the Etep
To enter EncrypTight licenses
Upgrading Etep Licenses
Next Steps
Upgrading Licenses
Upgrading the EncrypTight License
Next Steps
Installation and Configuration EncrypTight User Guide
Working with EncrypTight User Accounts
Managing EncrypTight Users
EncrypTight account types and privileges
Configuring EncrypTight User Authentication
Task Administrator User
Common Access Card Authentication
Password Authentication and Expiration
Login Session Inactivity Timer
DoD Login Banner
Parameter User Name Password
Login preferences default settings
EncrypTight user name and password conventions
Preference Setting
To modify an EncrypTight user account
Changing an EncrypTight User Password
To change a password
To add an EncrypTight user account
Relationship between EncrypTight users and Etep users
Example 1 Default EncrypTight user and default Etep user
Example 2 Setting up new EncrypTight and Etep users
How EncrypTight Users Work with Etep Users
Example 3 Adding a new Etep user to EncrypTight
About the EncrypTight Workspace
Maintenance Tasks
Working with the EncrypTight Workspace
On the File menu, click Save Workspace To
Saving a Workspace to a New Location
To save a workspace to a new location
To load an existing workspace
Loading an Existing Workspace
To delete a workspace
Moving a Workspace to a New PC
Deleting a Workspace
To move a workspace to a new PC
Schedule the Upgrade
Installing Software Updates
Verify Etkms Status and Deploy Policies
Upgrade the EncrypTight Software
Prepare Etpm Status and Renew Keys
To deploy policies
Upgrade PEP Software
FTP server site information for appliance software upgrades
To upgrade software on the PEPs
On the Tools menu, click Upgrade Software
To check the status of the PEPs
Click Edit Multiple Configurations Software Version
Change the PEP Software Version and Check Status
To change the software version of the PEPs
To stop and remove the current Etkms software
Return Status Refresh and Key Renewal to Original Settings
Upgrading External ETKMSs
To start the Etkms software
To install the new Etkms software
To configure the new Etkms software
To mount the Cdrom drive
Maintenance Tasks EncrypTight User Guide
Etems
Part II Working with Appliances using
EncrypTight User Guide
Etems Quick Tour
Defining Appliance Configurations
Getting Started with Etems
Interface configuration for a new ET1000A appliance
Pushing Configurations to Appliances
Upgrading Appliance Software
Comparing Configurations
Maintenance and Troubleshooting
Policy and Certificate Support
Understanding the Etems Workbench
Editors
Appliance Manager perspective Views
Etems toolbar
Toolbars
Perspectives
To open a perspective
Certificate Manager toolbar
Status Indicators
Appliance Manager toolbar
EncrypTight User Types
Appliance status indicators
Status Indicator Description
Understanding Roles
To change communication preferences
Function Administrator Ops
Modifying Communication Preferences
Appliance roles for ETEPs
Preference Description
Strict authentication communication preferences
General communication preferences
Policy Extensions
Ignore CRL access
Enable Certificate
CRL File Location
Provisioning Basics
Provisioning Appliances
New Appliance editor for the ET1000A To add a new appliance
Adding a New Appliance
On the Tools menu, click Put Configurations
Saving an Appliance Configuration
Saving appliance configurations
To push Etems configurations to appliances
Result Description
Put configuration status
Viewing Appliance Status
Appliances view
To configure automatic status checking
Etems
To apply a filter to the appliances in the Appliances view
Filtering Appliances Based on Address
Etep User Roles
Rebooting Appliances
To reboot appliances
Appliance User Management
Appliance roles for ETEPs v 1.4 and later
Configuring the Password Enforcement Policy
Default user names and passwords on the Etep
Role Default user name Default password
User Name Conventions
Default Password Policy Conventions
Strong Password Policy Conventions
Upgrading Software
Removing ETEPs From Service
On the Tools menu, click Appliance User Add User
Managing Appliance Users
Adding Etep Users
To add a user to the Etep
Default password Strong password Parameter Policy
Password policy values
On the Tools menu, click Appliance User Modify User
Modifying Etep User Credentials
Deleting Etep Users
To modify Etep user credentials
On the Tools menu, click Appliance User Delete User
Viewing Etep Users
To delete a user from the Etep
On the Edit menu, click Default Configuration
Working with Default Configurations
Customizing the Default Configuration
To customize the default configuration
Provisioning Large Numbers of Appliances
Restoring the Etems Default Configurations
To return the default values to factory settings
On the Edit menu, click Default Configurations
Importing Configurations from a CSV File
Creating a Configuration Template
Attribute Description
To import appliance configurations to Etems
Remote and local keywords and attributes
Importing Remote and Local Interface Addresses
Changing Configuration Import Preferences
To shut down the Etep
Shutting Down Appliances
Checking the Time on New Appliances
Shutdown operational codes
Managing Appliances
Editing Configurations
To change the management IP address on the appliance
Changing the Management IP Address
Changing the Address on the Appliance
Change Management IP window Related topics
Changing the Address in Etems
Operation failed message in response to management IP change
Changing the Date and Time
To change the date and time
Changing Settings on a Single Appliance
Changing Settings on Multiple Appliances
To edit the configuration of a single appliance
Deleting Appliances
To update an appliance setting on multiple appliances
To delete appliances
Connecting Directly to an Appliance
Connecting to the Command Line Interface
Upgrading Appliance Software
124 EncrypTight User Guide
To upgrade software
126 EncrypTight User Guide
Checking Upgrade Status
Restoring the Backup File System
Canceling an Upgrade
What to do if an Upgrade is Interrupted
To restore the appliance file system from a backup copy
Part III Using Etpm to Create Distributed Key Policies
130 EncrypTight User Guide
To open Etpm
Getting Started with Etpm
Opening Etpm
About the Etpm User Interface
Etpm perspective
Component Chapter
EncrypTight Components View
Editors
To edit an element from the policy view
Etpm Status Indicators
Status indicators
Policy View
Sorting and Using Drag and Drop
Etpm toolbar
To enable or disable automatic status checking
Etpm Toolbar
Etpm Status Refresh Interval
Ethernet Policies
About Etpm Policies
IP Policies
Policy generation and distribution
Policy Generation and Distribution
Key generation with one Etkms
Key generation with multiple ETKMSs
Creating a Policy An Overview
Network Set B
Network a
Network B
Network Set a
To create a policy
144 EncrypTight User Guide
EncrypTight User Guide 145
146 EncrypTight User Guide
Provisioning PEPs
Managing Policy Enforcement Points
Adding a New PEP in Etems
EncrypTight PEP configuration
Configuration Description
On the Advanced tab, select Enable Sntp Client
On the Features tab, select Enable passing TLS traffic
Adding Large Numbers of PEPs
Adding a New PEP Using Etpm
To add a new PEP using Etpm
Editing PEPs
Pushing the Configuration
To push Etems configurations to PEPs
To edit a PEP’s configuration
Editing PEPs From Etpm
To change the NTP settings for multiple PEPs
Select Edit Multiple Configurations Sntp Client
Editing Multiple PEPs
To change the IP address of a PEP
Deleting PEPs
Changing the IP Address of a PEP
Changing the PEP from Layer 3 to Layer 2 Encryption
To delete PEPs
Etkms connections
Managing Key Management Systems
To add an Etkms
Adding ETKMSs
To edit an existing Etkms
Editing ETKMSs
Deleting ETKMSs
Etkms entries
To delete an existing Etkms
Adding Networks
Managing IP Networks
Address Network Mask
To add a network
Network entries
Network IP
Grouping Networks into Supernets
Advanced Uses for Networks in Policies
Using Non-contiguous Network Masks
IP Address Network Mask
Networks definitions
To edit an existing network
Editing Networks
Deleting Networks
To delete a network
Managing IP Networks 166 EncrypTight User Guide
Network Sets
Managing Network Sets
IP address Mask 40.55.11.0 255.255.255.0
Types of Network Sets
IP address Mask 40.32.21.0 255.255.255.0
IP address Mask
Network set for a collection of networks
Network Set fields
Adding a Network Set
To add a Network Set
Mode
Key Management
System
Network Addressing
Network Set editor
Importing Networks and Network Sets
Networks and network sets import document format in Excel
To edit a Network Set
Editing a Network Set
Deleting a Network Set
To import networks and network sets into Etpm
To delete an existing network set
Managing Network Sets 176 EncrypTight User Guide
To add a new Vlan ID Range
Creating Vlan ID Ranges for Layer 2 Networks
Adding a Vlan ID Range
Upper Vlan ID
Vlan ID range entries
Lower Vlan ID
To delete an existing Vlan ID range
Editing a Vlan ID Range
Deleting a Vlan ID Range
To edit a Vlan ID range
180 EncrypTight User Guide
Policy Concepts
Creating Distributed Key Policies
Schedule for Renewing Keys and Refreshing Policy Lifetime
Policy Priority
Layer 2 Ethernet payload encryption
Policy Types and Encryption Methods
Encapsulation
To use Aria in an encryption policy, do the following
Encryption and Authentication Algorithms
Aria Encryption
Key Generation and ETKMSs
Addressing Mode
Using Encrypt All Policies with Exceptions
Policy Policy Type Priority Action Protocol Covered
Policy Size and Etep Operational Limits
Encrypt all policy with exceptions
Minimizing Policy Size
To add a new Layer 2 mesh policy
Adding Layer 2 Ethernet Policies
Layer 2 Mesh policy entries
Layer 2 Mesh policy editor
Adding a Hub and Spoke Policy
Adding Layer 3 IP Policies
Hub and spoke policy entries
To add a new hub and spoke policy
Size
IPSec
Addressing
Minimize Policy
Hub and spoke policy editor
To add a new mesh policy
Adding a Mesh Policy
Mesh policy entries
Specifies a method for reducing the policy size
Mesh policy editor
Multicast network example
Adding a Multicast Policy
Multicast policy entries
To add a multicast policy
Network
Multicast
Multicast policy editor
To add a point-to-point policy
Adding a Point-to-point Policy
Point-to-point policy entries
Point B
Point a
Network Set
Point a Ports
Point-to-point policy editor
Adding Layer 4 Policies
To create a new Layer 4 policy
Policy Deployment
Verifying Policy Rules Before Deployment
To verify policies
Setting Deployment Confirmation Preferences
To enable or disable the deployment warning
Deploying Policies
Editing policies
Editing a Policy
Deleting Policies
To edit an existing policy
Select Tools Clear Policies
To delete an existing policy
To delete all policies
Basic Layer 2 Point-to-Point Policy Example
Policy Design Examples
Point-to-point Layer 2 encryption policy
Layer 2 Ethernet Policy Using Vlan IDs
Setting PEP
Policy 3 Discard All Other
Policy 2 Partner and Partner Portal Server
Encrypt Traffic Between Regional Centers
Complex Layer 3 Policy Example
Encrypt all mesh policy
Encrypt Traffic Between Regional Centers and Branches
Network sets for mesh policy
Region a hub and spoke policy
Network sets for the hub and spoke policies
Field
Region B hub and spoke policy
Region C hub and spoke policy
Region D hub and spoke policy
Pass protocol 88 in the clear mesh policy
Passing Routing Protocols
EncrypTight User Guide 219
Policy Design Examples 220 EncrypTight User Guide
Part IV Troubleshooting
222 EncrypTight User Guide
Possible Problems and Solutions
Etems Troubleshooting
Preferences
Symptom Explanation and possible solutions
Config to Appliance
Appliance Unreachable
Disable-trusted-hosts CLI command
Appliance Configuration
Compare Config to Appliance . Do one of the following
Pushing Configurations
Appliance Tools Reboot
To ping the management port
Software Upgrades
About upgrades show system-log and show upgrade Status
Pinging the Management Port
Retrieving Appliance Log Files
Tools preferences To change the default ping tool
FTP server site information for log retrieval
To retrieve log files from an appliance
On the Tools menu, click Retrieve Appliance Logs
Viewing Statistics
Viewing Diagnostic Data
Statistic Description
Etep Statistics
Exporting SAD and SPD Files
Viewing Port and Discard Status
To access the appliance CLI
CLI Diagnostic Commands
To view the log information
Working with the Application Log
Viewing the Application Log from within EncrypTight
Exporting the Application Log
Setting Log Filters
Sending Application Log Events to a Syslog Server
Icon Description
Other Application Log Actions
Log File Actions
Monitoring Status
Etpm and Etkms Troubleshooting
Learning About Problems
Etpm status problems and solutions
Symptoms and Solutions
Etep PEPs, see the EncrypTight User Guide
Policy Errors
Renew Key Errors
Status Errors
Etkms Log Files
Viewing Log Files
Etpm Log Files
Etkms Server Operation
Etkms Troubleshooting Tools
Linux Commands
Command Description
Shutting Down or Restarting an External Etkms
PEP Troubleshooting Tools
Resetting the Admin Password
Optimizing Time Synchronization
To view statistics
To disable the Sntp client on multiple PEPs
Statistics
Etep PEP Policy and Key Information
To export SAD or SPD files from Etep PEPs
Troubleshooting Policies
Replacing Licensed ETEPs
Checking Traffic and Encryption Statistics
Viewing Policies on a PEP
Solving Policy Problems
Placing PEPs in Bypass Mode
Expired Policies
Allowing Local Site Exceptions to Distributed Key Policies
Cannot Add a Network Set to a Policy
Solving Network Connectivity Problems
Cannot Communicate with PEP
Certificate Implementation Errors
Modifying EncrypTight Timing Parameters
Invalid Parameter in Function Call
Etkms Boot Error
Invalid Certificate Error
Enter strict-client-authentication disable
To disable strict authentication on ETEPs
Etpm and Etkms Troubleshooting 252 EncrypTight User Guide
Part V Reference
254 EncrypTight User Guide
About the Etkms Properties File
Modifying the Etkms Properties File
Logging Setup
Hardware Security Module Configuration
Digital Certificate Configuration
Peer Etkms and Etpm Communications Timing
Base Directory for Storing Operational State Data
PEP Communications Timing
Policy Refresh Timing
PEP Communications Timing
Page
About Enhanced Security Features
Using Enhanced Security Features
About Strict Authentication
Order of Operations
Prerequisites for Using Certificates with EncrypTight
How to Reference
Prerequisites
Distinguished name information
Setting Description
Certificate Information
Usage, you type this string as follows
Using Certificates in an EncrypTight System
To change the EncrypTight keystore password
Changing the Keystore Password
Changing the EncrypTight Keystore Password
Changing the Etkms Keystore Password
Changing the Keystore Password on a Etkms
Restart the Etkms Service To start the Etkms service
Changing the Keystore Password on a Etkms with an HSM
Changing the Password Used in the Etkms Properties File
To change the password listed in the Etkms properties file
Click Enable Policy Extensions
Configuring the Certificate Policies Extension
To configure the certificate policies extension for ETEPs
Parameter Description
To configure certificate policy extensions for ETKMSs
Click Enable Certificate Policy Extensions
Etkms Certificate Policies Entries
EncrypTight User Guide 271
Generating a Key Pair
Working with Certificates for EncrypTight and the ETKMSs
To create the certificate request
Keytool genkeypair Command
Requesting a Certificate
To generate a key pair
Keytool Parameters for Importing a CA Certificate
To install a CA certificate
Importing a CA Certificate
Importing a CA Certificate Reply
Exporting a Certificate
Configuring the HSM for Keytool
Working with Certificates and an HSM
Generating a Key Pair for use with the HSM
Importing CA Certificates into the HSM
Importing Signed Certificates into the HSM
Working with Certificates for the ETEPs
Generating a Certificate Signing Request for the HSM
To start the Certificate Manager do one of the following
Understanding the Certificate Manager Perspective
Obtaining External Certificates
Certificate Manager Workflow
Working with External Certificates
To obtain a CA certificate from a CA
Installing an External Certificate
To install an external certificate
Requesting a Certificate
Working with Certificate Requests
282 EncrypTight User Guide
To view a pending certificate signing request
Installing a Signed Certificate
Viewing a Pending Certificate Request
Certificate usage
To set certificate request preferences
Canceling a Pending Certificate Request
Setting Certificate Request Preferences
To cancel a pending certificate request
Certificate request preference fields
Managing Installed Certificates
Exporting a Certificate
To export an installed certificate
Viewing a Certificate
To delete an external certificate
Validating Certificates Using CRLs
Validating Certificates
Deleting a Certificate
To use CRLs with the Etkms
Configuring CRL Usage in EncrypTight and the ETKMSs
Configuring CRL Usage on ETEPs
To use CRLs with the EncrypTight software
To view CRLs
Validating Certificates Using Ocsp
To install a CRL on the Etep
Handling Revocation Check Failures
Options Description
To set up Ocsp in EncrypTight
Click Enable Online Certificate Status Protocol Ocsp
EncrypTight Ocsp Options
Ocsp Settings
To set up Ocsp in the Etkms
To set up Ocsp on the ETEPs
Click Enable Ocsp
To enable strict authentication on PEPs
Enabling and Disabling Strict Authentication
To enable strict authentication in the EncrypTight software
To enable strict authentication on the Etkms
Removing Certificates
To disable strict authentication
Clear the Enable Strict Client Authentication box
To disable strict authentication from the command line
Select Tools Clear Certificates
Using a Common Access Card
To remove certificates
To add common names to the Etkms
Configuring User Accounts for Use With Common Access Cards
Enabling Common Access Card Authentication
To enable CAC Authentication in EncrypTight
To enable CAC Authentication on the Etep
Click XML-RPC Certificate Authentication
To enable CAC Authentication on the Etkms
Handling Common Name Lookup Failures
To specify how to handle common name failures
Using Enhanced Security Features 298 EncrypTight User Guide
Etep Configuration
Appliance Name
Identifying an Appliance
Product Family and Software Version
Throughput Speed
Interface Configuration
To configure appliance interfaces
Management Port Addressing
ET0100A interfaces configuration Related topics
IPv4 management port addressing
IPv4 Addressing
IPv6 management port addressing
IPv6 Addressing
Link speeds on the management port
Auto-negotiation All Ports
Link speeds on the local and remote ports
Remote and Local Port Settings
Transparent Mode
Local and Remote Port IP Addresses
When to use transparent mode
Policy Type Mode of operation
IP Address and Subnet Mask
Transmitter Enable
Default Gateway
Dhcp Relay IP Address
Transmitter Enable settings on the Etep
Ignore DF Bit
Reassembly Mode
Ignore DF Bit settings
Reassembly mode settings
Trusted host list
Trusted Hosts
Outbound host Appliance Editor Tab
Inbound trusted host protocols used by EncrypTight
To add a trusted host
Protocol
System Information
Snmp Configuration
Under Community Strings, click Add
Community Strings
Snmp system information
To define a community name
Trap Description
Traps
Traps reported on the Etep
SNMPv3
To configure a trap host
SNMPv2 Trap Hosts
SNMPv3 Configuration Related topics
To retrieve engine IDs
Generating the Engine ID
Retrieving and Exporting Engine IDs
Viewing SNMPv3 Engine IDs Related topics
Configuring the SNMPv3 Trap Host Users
SNMPv3 trap host users
SNMPv3 Trap Host configuration To configure a trap host user
Etep Logging tab
Logging Configuration
Facility Description
Log Event Settings
Log facilities
Under Syslog Servers, click Add
Defining Syslog Servers
Log priorities
To define a syslog server
Internals logs
Log File Management
Log file sizes
Log name File size
Log files extracted from the Etep Related topics
Advanced Configuration
Packet Payload Size Layer 2 Etep Layer 3 Etep
Path Maximum Transmission Unit
Valid Pmtu ranges on Etep appliances
Pmtu and fragmentation behavior on the Etep
Non IP Traffic Handling
CLI Inactivity Timer
Password Strength Policy
Non IP traffic handling configuration
XML-RPC Certificate Authentication
IKE Vlan Tags
SSH Access to the Etep
Sntp Client Settings
To configure the NTP client
IKE Vlan Tags
Features Configuration
Ocsp Settings
Certificate Policy Extensions
Encryption algorithms Authentication algorithms
Fips Mode
Enabling Fips Mode
Fips approved encryption and authentication algorithms
Operational Notes
Policy Type Action upon entering Fips mode
Disabling Fips
Verifying Fips Status on the Etep
Setting Definition
EncrypTight Settings
EncrypTight settings
Working with Policies
Encryption Policy Settings
Encryption policy settings
To launch Etpm from Etems
Using EncrypTight Distributed Key Policies
Creating Layer 2 Point-to-Point Policies
Etep Policy tab
Selecting a Role
Using Preshared Keys for IKE Authentication
Using Group IDs
Parameter Value
Selecting the Traffic Handling Mode
How the Etep Encrypts and Authenticates Traffic
IKE Phase 2 Parameters
Interfaces
Factory Defaults
Interfaces defaults
Interfaces Default Setting
Trusted Hosts
Trusted hosts defaults
Snmp defaults
Advanced
Logging
Policy
Features Default Setting
Features
Hard-coded Settings
Features defaults
Numerics
Index
Index
EncrypTight User Guide 345
Etpm
See also HSM Https TLS
348 EncrypTight User Guide
EncrypTight User Guide 349
350 EncrypTight User Guide
See also TLS trap configuration
352 EncrypTight User Guide
Black Box Tech Support FREE! Live /7