Filter
Top Products
Creating Distributed Key Policies
182 EncrypTight User Guide
● “Key Generation and ETKMSs” on page 185
● “Addressing Mode” on page 185
● “Using Encrypt All Policies with Exceptions” on page 185
● “Policy Size and ETEP Operational Limits” on page 186
● “Minimizing Policy Size” on page 187
Policy Priority
You can assign a priority from 1 to 65000 to each policy that you create. The policy priority specifies the
order in which policies are processed on the PEP. For each incoming packet or frame the PEP searches
through the list of policies, starting with the policy that has the highest priority, until it finds a match.
When it finds a match, the PEP processes the packet or frame according to the settings in the policy. As
you create policies, carefully consider the policy priority that you choose.
If your policies are not being implemented as expected, check the priorities assigned to the policies.
Incorrect prioritization can produce unexpected results. For example, policy A is a clear policy for a
specific destination network for any protocol and has the highest priority. Policy B is an encrypt policy
for the same destination network with a particular protocol, but it has a lower priority. Because policy A
has the higher priority, all traffic passes and none of the traffic is encrypted.
Schedule for Renewing Keys and Refreshing Policy
Lifetime
The Renew keys/Refresh lifetime value specifies the length of time that the keys and policies will be
active. According to the schedule specified in the policy, the ETKMS sends new keys to the PEPs. The
previous keys are maintained on the PEP for up to five minutes to ensure that no traffic interruption
occurs. For Bypass and Drop policies (which do not have keys), the policy lifetimes are refreshed.
You schedule the key renewal and policy refresh in an interval of hours or set a daily renewal at a
specified time.
● Hours - enter the re-key interval in hours between 0 and 65535 hours. Use 0 to effectively specify
that the keys and policies never expire and never update. (Technically, when you enter 0, ETPM
inserts the value of 61320 hours, or 7 years.) Most likely, you will only use 0 hours for drop and clear
policy types.
● Daily - enter the re-key time using the 24 hour system clock set to the required local time of the
ETPM workstation. The re-key time will translate to the local times of the ETKMSs and PEPs that
might be located in other time zones.
TIP
Management traffic increases during the policy rekey and renew lifetime process. This is true for both
manual and automatic rekeys. If you schedule all policies to rekey at the same time, the ETKMSs will send
new keys to all of their PEPs at the same time, causing an increase in traffic throughout your network. You
can reduce the traffic and processing time by staggering the rekey schedule specified for each policy. For
example, one policy could be set to rekey at 1:00 AM while another policy could be set to rekey at 1:30
AM. This significantly reduces the management traffic and
PEP processing time.