Black Box ET0100A, ET1000A, ET0010A manual Out-of-band Etkms management in an Ethernet network

EncrypTight Deployment Planning

Figure 8 In-line ETKMS management in an IP network

ETPM and ETKMS in Layer 2 Ethernet Policies

With Ethernet networks, you use Layer 2 PEPs. As with IP networks, when managing the ETPM and external ETKMS in-line the communications path between the devices must pass through one or more PEPs and potentially one or more firewalls. For in-line management with Layer 2 PEPs be sure that the Enable passing TLS traffic in the clear feature is selected in the ETEMS Appliance editor.

If you need to pass additional traffic in the clear, such as routing protocols, you can route the management communications using out-of-band connections or put your management traffic on a separate VLAN.

If you choose to put the management traffic on a separate VLAN, you will need to create a Layer 2 policy to pass packets with this VLAN tag in the clear. To prevent an interruption in management traffic, set the policy’s key renewal/lifetime to zero, so that the policy does not expire.

With out-of-band management, the management traffic between the ETPM and ETKMS is routed over a separate network path through the ISP. When the communications path passes through any firewalls, be sure to configure the firewall to pass TLS traffic. Figure 9 shows an out-of-band management scenario with the ETPM connecting to an external ETKMS with Layer 2 PEPs encrypting Ethernet data.

Figure 9 Out-of-band ETKMS management in an Ethernet network

28 EncrypTight User Guide