Black Box ET0010A User Manual

Adding Layer 3 IP Policies

EncrypTight User Guide

193

Specifies the encryption and authentication algorithms used in an IPSec policy.
Select the encryption algorithm from the Encryption Algorithms list:
• AES - Advanced Encryption Standard (default)
• 3DES - a more secure variant of Data Encryption Standard 
Select the authentication algorithm from the Authentication Algorithms list:
• HMAC-SHA-1 - Secure Hash Algorithm
• HMAC-MD5 - Message Digest 5
Note: Layer 4 policies require AES and HMAC-SHA-1.

Specifies the key generation and distribution mechanism for the PEPs included 

in the policy. 
• By Network Set - The default ETKMS within each network set generates 

and distributes the keys to the PEPs included in those network sets.

• Global ETKMS - A global ETKMS generates the keys and sends them to 

the default ETKMSs in each network set for distribution to all of PEPs 

included in the policy.
Select the desired ETKMS from the Global ETKMS list.

Overrides the Network addressing setting for the network sets. 
• Preserve internal network addresses - This setting overrides the network 

set’s network addressing mode and preserves the network addressing of the 

protected networks. The IP header contains the source address of the 

originating network. 
If this setting is disabled and the addressing mode of the network set uses 

the PEP’s remote IP address or a Virtual IP address, the IP header contains 

the source address as specified in the network set. If the addressing mode 

of the network set preserves the network IP address, disabling this setting 

has no effect.

• Preserve address, protocol and port - This setting overrides the network 

set’s addressing mode and preserves the network addressing of the 

protected networks, as well as the specified protocol and port numbers. The 

IP header includes the source address, protocol, and port of the originating 

network. This allows you to send the Layer 4 header information in the clear 

for traffic engineering and Service Level Agreement (SLA) management (for 

example, Quality of Service controls). 

Reduces policy size by ignoring the network addresses on the local port of the 

PEP. This reduces the amount of network traffic needed to renew keys and 

refresh policy lifetimes.
• Minimize Policy Size (ignore source IP address) - This setting replaces 

the source network address for outbound traffic and the destination network 

address for inbound traffic with all networks wildcard addresses (0.0.0.0/0). 

. 

Identifies the network sets included in this policy.
Click the Network Sets tab of the EncrypTight Components view and drag the 

appropriate network sets to either Hubs or Spokes.

Specifies the Layer 3 protocol affected by this policy. The action selected for 

the policy is only applied to the traffic with the specified protocol.
• Any - specifies all protocols
• Only - specifies a particular protocol. Click to select and then enter the 

required protocol in the range 0 to 255.