Black Box ET1000A, ET0010A EncrypTight Deployment Planning, EncrypTight Component Connections

2 EncrypTight Deployment Planning

When deploying EncrypTight, you must plan the following:

●EncrypTight Component Connections

●Network Clock Synchronization

●IPv6 Address Support

●Certificate Support

●Network Addressing for IP Networks

EncrypTight Component Connections

EncrypTight can be managed in-line or out-of-band. When managing in-line, management traffic flows through the data path. You must enable the Passing TLS traffic in the clear feature on all PEPs for proper communication among EncrypTight components (ETEMS, ETPM, ETKMS, PEPs). When passing TLS in the clear is enabled on Layer 2 PEPs, TLS and ARP packets are sent unencrypted.

If your network uses other routing protocols that need to pass in the clear, consider the following:

●At Layer 3, create policies to pass the routing protocols in the clear. The PEPs must also be configured to pass non-IP traffic in the clear (this is the default setting on the Advanced tab in ETEMS).

●At Layer 2, consider a separate out-of-band management network, or put the management traffic on a separate VLAN and create a Layer 2 policy to pass packets with this VLAN tag in the clear. Customer support can advise you on a solution that works best in your network.

●Use local site policies

Local site policies allow you to create locally configured policies using CLI commands, without requiring an EncrypTight ETKMS for key distribution. Using the local-site CLI commands you can create manual key encryption policies, bypass policies, and discard policies at either Layer 2 or Layer 3. Mesh policies can be created by adding policies that share the identical keys and SPIs to multiple ETEPs.

The primary use for local site policies is to facilitate in-line management in Layer 2 encrypted networks. These policies supplement existing encryption policies, adding the flexibility to encrypt or pass in the clear specific Layer 3 routing protocols, or Layer 2 Ethertypes and VLAN IDs.

For information on creating and using local site policies, see the CLI User Guide.

This chapter discusses connections between each of the EncrypTight components, providing in-line and out-of-band examples.

EncrypTight User Guide 25