Appliance Trim Kit User Manual

Adding Layer 3 IP Policies
EncrypTight User Guide 201
IPSec Specifies the encryption and authentication algorithms used in an IPSec policy.
Select the encryption algorithm from the Encryption Algorithms list:
•AES - Advanced Encryption Standard (default)
•3DES - a more secure variant of Data Encryption Standard
Select the authentication algorithm from the Authentication Algorithms list:
• HMAC-SHA-1 - Secure Hash Algorithm
• HMAC-MD5 - Message Digest 5
Note: Layer 4 policies require AES and HMAC-SHA-1.
Key Generation Specifies the global ETKMS used in the multicast network. A global ETKMS
generates the keys and sends them to the default ETKMSs in each network set
for distribution to all of PEPs included in the policy.
Select the desired ETKMS from the ETKMS list.
Addressing
Mode Override
Overrides the Network addressing setting for the network sets.
• Preserve internal network addresses - This setting is always enabled for
multicast policies and cannot be disabled. By default, multicast policies
override network set’s network addressing mode and preserve the network
addressing of the protected networks. The IP header contains the source
address of the originating network.
• Preserve address, protocol and port - This setting overrides the network
set’s addressing mode and preserves the network addressing of the
protected networks, as well as the specified protocol and port numbers. The
IP header includes the source address, protocol, and port of the originating
network. This allows you to send the Layer 4 header information in the clear
for traffic engineering and Service Level Agreement (SLA) management (for
example, Quality of Service controls).
Minimize Policy
Size
Reduces policy size by ignoring the network addresses on the local port of the
PEP. This reduces the amount of network traffic needed to renew keys and
refresh policy lifetimes.
• Minimize Policy Size (Ignore Source IP) - This setting replaces the source
network address for outbound traffic with an all networks wildcard address
(0.0.0.0/0). For more information, see “Minimizing Policy Size” on page 187.
Multicast
Network
Identifies the multicast address range protected by this policy.
•IP - multicast IP address
•Mask - mask for the multicast IP address
Network Sets Identifies the networks included in this policy.
Click on the Network Sets tab of the EncrypTight Components view and drag
the appropriate network sets to the desired columns.
•Send - lists the networks that only send data
• Receive - lists the networks that only receive data
• Send and Receive - lists the networks that send and receive data
ETPM supports technologies such as Protocol Independent Multicast (PIM) by
providing the ability to have multiple senders, receivers, and senders/receivers
in multicast policies.
Table 50 Multicast policy entries (continued)
Field Description