Black Box EncrypTight User manual

BL A C K B OX®

EncrypTight acts as a transparent overlay that

integrates easily into any existing network

architecture, providing encryption rules and keys

to EncrypTight Enforcement Points.

EncrypTight consists of a suite of tools that performs various tasks of

appliance and policy management, including Policy Manager (PM),

Key Management System (KMS), and EncrypTight Enforcement Points

(ETEPs).

EncrypTight Getting Started Guide

ET0010A

ET0100A

ET1000A

Order toll-free in the U.S.: Call 877-877-BBOX (outside U.S. call 724-746-5500)

FREE technical support 24 hours a day, 7 days a week: Call 724-746-5500 or fax 724-746-0746

Mailing address: Black Box Corporation, 1000 Park Drive, Lawrence, PA 15055-1018

Web site: www.blackbox.com • E-mail: info@blackbox.com

Customer

Support

Information

EncrypTight — Getting Started

This guide is intended as a jump start to using the EncrypTight system. This guide assumes that you have

already installed and cabled your ETEPs and at least one ETKMS. It describes how to configure the

ETEPs and the ETKMS and the basic methods for creating Layer 2 and Layer 3 policies.

This guide includes the following topics:

●Before You Begin

●Overview - Elements of the EncrypTight System

●Setting Up ETEPs

●Configuring the ETKMS

●Starting the EncrypTight Software

●Installing the EncrypTight License

●Configuring Appliances in ETEMS

●Creating a Layer 2 Policy

●Creating a Layer 3 Policy

Before You Begin

The EncrypTight system is a licensed product. After you install the EncrypTight software, contact

Customer Support to acquire your license key. You will need to provide the EncrypTight ID. To view the

EncrypTight ID, choose Edit > License. Contact Customer Support at:

Phone: 724-746-5500

Fax: 724-746-0746

Email: info@blackbox.com

Overview - Elements of the EncrypTight System

The EncrypTight system includes:

●EncrypTight Enforcement Points (ETEPs)

ETEPs are encryption appliances that enforce the security policies that you create in the EncrypTight

Policy Manager (ETPM). In ETPM, encryption appliances are referred to as Policy Enforcement

Points (PEPs).

●One or two EncrypTight Key Management Systems (ETKMS)

The ETKMS generates encryption keys and distribute the policies to the ETEPs.

Setting Up ETEPs

2EncrypTight — Getting Started

●EncrypTight software, including EncrypTight Element Management System (ETEMS) and

EncrypTight Policy Manager (ETPM).

ETEMS is an element manager that you use to configure the ETEPs. ETPM is the policy generation

and management tool.

Setting Up ETEPs

In order to use the ETEPs, after you connect the appropriate cables, you must log in through the serial

port and use CLI commands to assign an IP address, network mask, and default gateway for the

management port. You can also set the date and time.

Logging In Through a Serial Link

Initial setup is performed through a serial link to the RS-232 port.

To log in to the CLI via a serial link:

1 Connect the RS-232 serial port directly to a PC or workstation.

2 Open a terminal session through a VT-100 terminal emulation program such as HyperTerminal. Enter

the connection name, the appropriate serial port (usually COM1 or COM2), and the following serial

port parameters:

3 In the terminal session window, press ENTER. The login prompt displays.

4 At the login prompt, type the default user name admin and press ENTER. User names and

passwords are case-sensitive.

5 At the password prompt, type the default password admin and press ENTER.

6 When you are successfully logged in, the command line prompt displays as shown below (password

text is not displayed).

pep login: admin

Password:

Last login: Tue Jan 29 19:18:59 2010 on ttyS0

Welcome admin it is Tue Jan 29 19:37:12 UTC 2010

admin>

It is recommended that you change the default passwords when you configure the ETEP for operation

using ETEMS. See the EncrypTight documentation for more information about user management.

Baud Speed 38,400

Parity None

Data Bits 8

Stop Bits 1

Flow Control None

Setting Up ETEPs

EncrypTight — Getting Started 3

CAUTION

Keep track of the passwords you assign. If you lose the admin password, you can lose the ability to

communicate with and manage the appliance. In some cases, restoring the unit to working order can

require factory service.

Initial ETEP Configuration

ETEPs can be managed in-line or out-of-band through a dedicated Ethernet management interface. To use

the ETEP in an EncrypTight deployment, the basic configuration includes specifying an IP address for the

management port and setting the date and time.

The Ethernet management port IP address identifies the ETEP to the management workstation. The

subnet mask is the portion of the IP address that identifies the network or subnetwork for routing

purposes.

When the ETEP management port and the management workstation or the ETKMS are on different

subnets, the ETEP uses a default gateway to route packets to the other devices. The default gateway

identifies the local router port that is on the same subnet as the ETEP Ethernet management port.

Figure 1 shows an example of a default gateway when the management station and ETEP are on different

subnets. The management station’s IP address is 192.168.1.10, and the ETEP’s management port IP

address is 192.168.10.10. To send packets between the two devices, the local port on Router #1 is

specified as the default gateway (192.168.10.1). The gateway address must match the subnet of the

management port.

Figure 1 Management Port Default Gateway

To configure the management port:

1 At the command prompt, type configure to enter configuration mode.

2Attheconfig> prompt, type management-interface.

3 To assign the management port IP address, mask, and gateway, type

ip <ip address> <subnet mask> [gateway]

ip address Management port IP address, entered in dotted decimal notation.

subnet mask IP subnet mask, entered in dotted decimal notation.

Configuring the ETKMS

4EncrypTight — Getting Started

After entering the new IP address, it takes 10-20 seconds for the ETEP to set the address on the

management port. During that time you cannot enter any CLI commands. When the operation is

complete, the man-if> prompt is displayed.

4 Auto-negotiation is enabled by default. If you want to disable auto-negotiation and manually set the

link speed and flow control, configure the autoneg command. For instructions, refer to the ETEP

Installation Guide.

5Type

exit to return to the config prompt.

6 The time zone on the ETEP is set to UTC 0 (Coordinated Universal Time), and is not user

configurable. At the config> prompt, type date <year> <month> <day> <hour>

7Typeexit to return to the command prompt.

Example:

The following example sets the management port IP address, subnet mask, and gateway for the ETEP

as shown in Figure 1. It also sets the date and time. Auto-negotiation is left at its default setting of

enabled.

admin> configure

config> management-interface

man-if> ip 192.168.10.10 255.255.255.0 192.168.10.1

man-if> exit

config> date 2010 07 12 15 30 00

config> exit

Configuring the ETKMS

You can use either a local ETKMS or an external ETKMS. The local ETKMS is intended for use with

small to medium networks with no more than 10 nodes.

Although some of the essential configuration of the ETKMS is the same for both local a ETKMS and an

external ETKMS, the procedures for configuring each are different. For this reason, the basic

configuration of a local ETKMS is discussed separately.

Basic Configuration for a Local ETKMS

When you use a local ETKMS, the ETKMS software runs on the same workstation as the EncrypTight

software. Keep in mind the following information:

●Although the EncrypTight application does not need to remain open, the ETKMS software needs to

run continuously in order to renew keys and refresh policies. For this reason, install the EncrypTight

software on a reliable workstation. In addition, disable the Windows standby and hibernation modes.

gateway Specifies how to route traffic between the ETEP management port and the

management station or ETKMS. When the management port is on a different

subnet than the management station or ETKMS, specify the IP address of the

router’s local port on the same subnet as the ETEP management port (see

Figure 1). If the devices are on the same subnet, you do not need to enter a

default gateway.

Configuring the ETKMS

EncrypTight — Getting Started 5

The local ETKMS software cannot renew keys and refresh policy lifetimes if the workstation enters

standby or hibernation mode.

●It is strongly recommended that you assign a static IP address to the local ETKMS. If the local

ETKMS IP address does not match the management station IP address, an error is generated when

you attempt to launch the local ETKMS.

●The local ETKMS uses the time and date settings in effect on the workstation on which the

EncrypTight software is installed. Because EncrypTight is dependant on network-wide clock

synchronization, it is strongly recommended that you set up the management workstation to

synchronize with an NTP server rather than setting the date and time manually. You should use the

same time service for the EncrypTight workstation and the PEPs.

●You cannot run web server software on the same workstation as the EncrypTight software. The

ETKMS application must use port 443. Running a web service on the same workstation generates an

error message when you attempt to launch the local ETKMS.

To learn more about using a local ETKMS, see the EncrypTight User Guide.

Setting the IP address for a Local ETKMS

You set the IP address for a local ETKMS when you add the ETKMS in the ETEMS Appliance Manager.

The IP address must be the IP address of the workstation on which EncrypTight is installed.

To add a local ETKMS:

1 In the Appliance Manager, click File > New.

2 In the New Appliance editor, from the Product Family box, select ETKMS LM.

3FromtheSoftware Version box, select the appropriate software version.

4IntheAppliance Name box, enter a name for this local ETKMS.

5IntheIP Address box, enter the IP address of the workstation on which EncrypTight is installed.

6 Optionally, in the Backup IP Address box, enter the IP address of a backup ETKMS. Usually, a

backup ETKMS is used with an external ETKMS. For more information about backup ETKMSs, see

the EncrypTight User Guide.

7ClickSave.

Launching and Stopping a Local ETKMS

When you launch a local ETKMS, the ETKMS software runs as a separate application in a command line

window on the management workstation. If the management workstation running the local ETKMS

restarts, you must relaunch the local ETKMS. The local ETKMS does not have a web interface. It is

managed through ETEMS.

To launch a local ETKMS:

1 In the Appliance Manager, select the local ETKMS.

2ClickTools > Launch ETKMS LM.

The ETKMS software starts and opens a command line window.

Configuring the ETKMS

6EncrypTight — Getting Started

To stop a local ETKMS:

1 Switch to the command line window in which the local ETKMS is running.

2PressCTRL + C.

3TypeY.

Configuring an External ETKMS

After you connect the appropriate cables to the ETKMS server, you need to log in to the ETKMS, set up

the network interface with an IP address and hostname, and specify an NTP server to use. Once the

ETKMS is configured, add it to the list of appliances managed by ETEMS.

Logging Into the ETKMS

To configure the ETKMS, you must connect the monitor, keyboard, and mouse and log into the server

directly.

The ETKMS has two default user accounts, admin and root. The default password for the admin account

is admin. The default password for the root user is password. You can use the admin account to log into

the ETKMS remotely using SSH. The root user can only log into the ETKMS directly. You must log in

as root to configure the ETKMS.

To maintain the security of your system and networks, it is strongly recommended that you change the

default admin password and the default root password as one of your first tasks. The first time you log

into the ETKMS as admin, you must change the admin password.

To log into the ETKMS:

1 At the login prompt, enter a user name and press Enter.

2 At the Password prompt, enter the password and press Enter.

Change the Default Passwords

To maintain system security, it is strongly recommended that you change the default passwords for the

ETKMS administrator user (admin) and the root password periodically.

CAUTION

Keep track of the passwords you assign. If you lose these passwords, you can lose the ability to

communicate with and manage the ETKMS. In some cases, restoring the unit to working order can require

factory service.

Changing the Admin Password

The default password for the admin account is admin. Changing the default admin password is an

essential step in maintaining the security of the ETKMS and EncrypTight. The first time you log in as

admin, you must change the password. Use the following to change the password after that first log in.

Configuring the ETKMS

EncrypTight — Getting Started 7

To change the admin password:

1 Log in as admin.

2Type

passwd and press Enter.

3 At the prompt, type the current password and press Enter.

4 At the prompt, type the new password and press Enter.

The new password must be at least six characters long, contain a sufficient number of different

characters, and must not be a common dictionary word.

5 At the prompt, retype the new password and press Enter.

6Type

exit to log out from the admin account.

For example:

Localhost login: admin

Password:

[admin@localhost ~] $ passwd

(current) UNIX password:

New UNIX password:

Retype new UNIX password:

passwd: all authentication tokens updated successfully.

[admin@localhost ~] exit

Changing the Root Password

The default password for the root user is password. It is strongly recommended that you change the

default root password when you initially set up the ETKMS server. The new password for the root user

must be at least seven characters long and contain a sufficient number of different characters.

To change the root password:

1 Log in as root.

2Type

passwd and press Enter.

3 Follow the prompts to change the root password.

Remain logged in as root to complete the ETKMS configuration.

CAUTION

Keep track of the passwords you assign. If you lose these passwords, you can lose the ability to

communicate with and manage the ETKMS. In some cases, restoring the unit to working order can require

factory service.

Configure the Network Connection

You can set a static IP address using the web interface. The eth0 connection is the network connection

with a path to the management workstation containing the ETPM and to the PEPs’ management port. The

eth1 connection is inactive and unavailable. Set the network connection as required by your network

configuration.

Setting up the network connection requires running two scripts.

Configuring the ETKMS

8EncrypTight — Getting Started

To configure the network connection and hostname:

1 At the command prompt, type system-config-network.

2TabtotheEdit Devices option and press Enter.

3Tabtotheeth0 device and press Enter.

4 Make sure that DHCP is not selected (use the spacebar to clear any selection) and then enter the:

●Static IP

●Netmask

●Default Gateway IP address

5TabtoOK and press Enter.

6TabtoSave and press Enter.

7TabtoEdit DNS configuration and press Enter.

8 Enter the Hostname, Primary DNS, Secondary DNS, and Search information.

9TabtoOK and press Enter.

10 Tab to Save & Quit and press Enter.

11 At the command prompt, type /opt/etkms/bin/etc-hosts-config.sh and press Enter.

12 At the command line, restart the network service by typing service network restart and press

Enter.

13 At the command line, restart the ETKMS service by typing service etkms restart and press

Enter.

You can use the following commands to verify the IP address and hostname changes:

●At the command line, type ifconfig and press Enter to view the IP address.

●At the command line, type hostname and press Enter to view the full hostname, such as

serv4.company.com.

●Type hostname -s and press Enter to view the short hostname. In this example, if the full

hostname is serv4.company.com, the short name is serv4.

Configure Time and Date Properties

All EncrypTight components, including the ETKMS, should be synchronized with a time server. You

must be logged in as root to make these changes.

To set the time zone:

1 Edit the file

/etc/sysconfig/clock

2FortheZone value, specify the appropriate filename. Zone files are located in:

/usr/share/zoneinfo

You need to include the parent directory in the entry (for example, America/New_York).

3 Save and close the file.

To set up time synchronization:

1 Edit the file:

/etc/ntp.conf

Starting the EncrypTight Software

EncrypTight — Getting Started 9

2 Replace the lines listing the three default time servers with your preferred time server. You can

specify multiple time servers.

3 Save and close the file.

4 To set up the NTP daemon to start every time the server starts, at the command line, type:

chkconfig ntpd on

And press Enter.

Changes to the NTP settings do not take affect until you restart the NTP daemon or the entire server.

To restart the NTP daemon:

1 At the command line, type:

service ntpd restart

Starting and Stopping the ETKMS Service

The ETKMS runs as a service in Linux. Once the ETKMS is started, the ETKMS restarts after each

reboot of the Linux server.

To start the ETKMS service:

1 At the command line, type:

service etkms start

To stop the ETKMS service:

1 At the command line, type:

service etkms stop

Checking the Status of the ETKMS

You should check that the ETKMS service is running before you proceed to use EncrypTight.

To check the status of the ETKMS service:

1 At the command line, type:

service etkms status

Starting the EncrypTight Software

Only one user at a time can be logged in to ETEMS. User authentication is enabled by default. Use the

default userId and password to log in the ETEMS the first time. You can then change the default account

or disable user authentication.

Table of contents

Other Black Box Network Hardware manuals

Black Box

Black Box 5000 series User manual

Black Box

Black Box LrA502A-et-r5 User manual

Black Box

Black Box LB0010A-A24-R2 User manual

Black Box

Black Box V.35 FOLD-ST Series User manual

Black Box

Black Box IC457A-F User manual

Black Box

Black Box AC1059A User manual

Black Box

Black Box ME1240A-F User manual

Black Box

Black Box Internet Sharer FX850A User manual

Black Box

Black Box RF200A User manual

Black Box

Black Box SW1009A User manual

Black Box

Black Box EME149A-20 User manual

Black Box

Black Box LB510A User manual

Black Box

Black Box MT910A User manual

Black Box

Black Box EME1DC16 User manual

Black Box

Black Box LT0009A User manual

Black Box

Black Box 39625 User manual

Black Box

Black Box Balun G.703 User manual

Black Box

Black Box InvisaPC DTX1000-T User manual

Black Box

Black Box TL601A-R2 User manual

Black Box

Black Box LMX Series User manual

Black Box

Black Box NTU-1 User manual

Black Box

Black Box 525056 Instruction Manual

Black Box

Black Box Secure Site Manager 8 User manual

Black Box

Black Box AC1003A User manual

Popular Network Hardware manuals by other brands

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL product manual

B&B Electronics

B&B Electronics ZXT9-IO-222R2 product manual

Yudor

Yudor YDS-16 user manual

D-Link

D-Link ShareCenter DNS-320L datasheet

Samsung

Samsung ES1642dc Hardware user manual

Honeywell Home

Honeywell Home LTEM-PV Installation and setup guide

evertz

evertz 7700 Series manual

D-Link

D-Link ShareCenter DNS-343 Quick installation guide

Asante

Asante AsanteBridge 1012 user guide

FireBrick

FireBrick FB2700 user manual

Audiovox Electronics

Audiovox Electronics ARWH2T user manual

ADC

ADC DSX-1 Operational Procedures Guide

NetComm

NetComm NF2 user guide

Alcatel-Lucent

Alcatel-Lucent 5620 user guide

Dell EMC

Dell EMC XC6420 Series Solution guide

Lanner

Lanner NCA-1020A user manual

Allied Telesis

Allied Telesis AT-TN121-A Specifications

Arista

Arista CCA-ETM-Q12 quick start guide