Black Box EncrypTight, ET1000A, ET0010A Allowing Local Site Exceptions to Distributed Key Policies

Troubleshooting Policies

Do one of the following:

●In the Appliance Manager view, select the ETEP and choose Tools > Clear Policies.

●In ETPM, create a bypass policy and deploy it to the PEPs.

●For distributed key policies: In ETEMS, change the Encryption Policy setting on the Features tab from Layer 2 to Layer 3 (or vice versa), and push the configuration to the ETEP. Encrypt and drop policies are removed from the ETEP, and traffic passes in the clear until you create and deploy new policies.

●For Layer 2 point-to-point policies: In ETEMS, change the Traffic Handling setting on the Policy tab to EthClear, and push the configuration to the ETEP.

Related Topics:

●“Deleting Policies” on page 209

Allowing Local Site Exceptions to Distributed Key Policies

Local site policies allow you to create locally configured policies using CLI commands, without requiring an ETKMS for key distribution. Using the local-site CLI commands you can create manual key encryption policies, bypass policies, and discard policies at either Layer 2 or Layer 3.

The primary use for local site policies is to facilitate in-line management in Layer 2 encrypted networks. These policies supplement existing encryption policies, adding the flexibility to encrypt or pass in the clear specific Layer 3 routing protocols, or Layer 2 Ethertypes and VLAN IDs.

The local-site policy feature gives you the ability to define a set of policies for the in-line management protocols that need to be passed through the ETEP, such as EIGRP, OSPF, RIPv2, or BGP. These policies are high priority policies that are not affected when EncrypTight distributed key policies are deployed on the ETEP.

This feature is similar to the ETEP configuration option that allows TLS traffic to pass through the ETEPs in the clear, but it provides the additional flexibility of allowing you to specify several protocols and ports, and to restrict the policy to specific IP addresses. The policy action can be defined as Clear, Drop or Protect. Protect policies allow the in-line management traffic to be encrypted with user-defined manual keys.

You can use the local-site CLI commands to create a variety of policies:

●Pass Layer 3 routing protocols in the clear when encrypting traffic at Layer 2

●Encrypt in-line management traffic that is typically passed in the clear when deploying EncrypTight policies, such as TLS and ARP packets

●Create manual key encryption policies for Layer 2 or Layer 3 traffic

●Create discard policies based on Layer 2 selectors (Ethertype or VLAN ID) or Layer 3 selectors

To learn how to create local site policies to supplement your EncrypTight distributed key policies, see the ETEP CLI User Guide.

Expired Policies

Whenever you restore a previous file system on a PEP, it is possible that you could also restore a set of expired policies, old certificates, and out of date keys inadvertently. This can cause a number of different policy-related problems and affect communications between the ETKMS and the PEP.

EncrypTight User Guide 247