Copyright: Copyright © 2000 Intel Corporation. All rights reserved.


About Security Algorithms

Note: This is not available when access to the Policy Manager is enabled.

A single algorithm or a combination of two or three algorithms that can be used with a security action is called a proposal. A security action can have more than one propsal. You control the order of preference for the proposal in a particular security action.

In order for two computers to have secure communications, they must agree on a proposal. If they cannot agree, then there will be no security association.

Encryption and authentication types

Encryption algorithms

None. Choose None if you do not want to perform encryption in this proposal.

DES.  Data Encryption Standard. When you choose this encryption option, a 56-bit encryption algorithm is used.

Authentication algorithms

ESP authentication and AH authentication will specify one of the authentication algorithms listed below.

None. Choose None if you do not want use any algorithm for authentication.

MD5. Message Digest 5 Algorithm. This algorithm often used to verify the integrity of packets traveling on a network. The algorithm transforms any number of bytes into a fixed number of bytes; no other set of bytes produces the same result.

SHA-1. Secure Hash Algorithm 1. An algorithm often used to verify the integrity of packets traveling on a network. The algorithm transforms any number of bytes into a fixed number of bytes; no other set of bytes produces the same result.

About algorithm notation

Each security action can specify algorithms to use for encryption and authentication. There are three categories (Encryption, ESP [Encapsulation Security Payload] Authentication, and AH [Authentication Header] Authentication. The combination of algorithms for each of the three categories is called a proposal.

At least one of these categories must be used in proposal, or you can use two or even all three.

The Intel® Packet Protect monitor tool provides a kind of "shorthand" notation for describing the algorithms used in a security action--Encryption value + ESP value + AH value. For example, if you create a security action that uses DES for Encryption, SHA1 for ESP, and do not use AH, this would be shown as DES+SHA1+None.


Customize Security Actions

Use this window to manage a list of available security actions. You can create new actions, edit existing actions, or delete actions.

About this window

Security Action

Use this list to select a security action to view or edit. If you select a pre-defined security action, the options on the window are "grayed-out," meaning that you cannot make changes to that action.

Time limit

Select this box to set a time limit for this security action to be used. When you select this box, the time limit edit box becomes active. You can enter a time limit in either seconds, minutes, or hours. It will not accept a time limit less than 4 hours or more than 8 hours. Up to 5 digits can be entered.

Note:

You can specify a time limit for a security action. If you do, the security action will be run until the limit is reached. If the Time Limit box is unchecked, the default time limit applies.

Perfect forward secrecy

Select this box to use perfect forward security, that is, using a second set of keys. If you select this box, the system uses a second set of keys for generating security association.

Proposal

This section lists the three algorithm elements that you can use to create a security action proposal. You must use one of these elements in your proposal, or two or even three.

Encryption

Use the drop-down list to choose a type of encryption. The choices are DES or none. Encryption is not required, but some kind of encryption or authentication must be used for a security action.

ESP authentication

Use the drop-down list to choose a method for Encapsulated Security Payload authentication. The choices are MD5, SHA-1, and None. ESP authentication is not required, but some kind of encryption or authentication must be used for a security action.

Use Proposals in order of preference

This list contains all of the proposals that have been defined. When you negotiate a security association with another computer, your computer will use the first proposal in the list and work its way down the list until a security association can be negotiated.

You should place the proposals in the order that you want them considered when your computer negotiates a security association.

Select a proposal and use the Move Up and Move Down buttons to put the proposals in the desired order.


AH

Authentication Header. A method of verifying the integrity of packets, that is, the packets that are known to be from the originating computer. Packet Protect uses MD5 and SHA-1 to authenticate packets.


anti-replay

Protection against receiving repeated packets being transmitted on the network. This helps prevent an intruder from successfully sending the same packet repeatedly in an attempt to confuse the system (for example, the computer could repeat the task of restarting a server).


authentication

The process of verifying the identity of a computer. Packet Protect authenticates a computer using pre-shared keys. It helps verify that a computer is who it claims to be.


CA

Certificate Authority. A computer or organization that issues certificates signed by some hierarchy.


CA certificate

Certificate Authority certificate. A certificate issued to a certificate authority. CA certificates are well-published and trusted.


CDSA

Common Data Security Architecture. An interface developed by Intel that is designed as an overall infrastructure for data security on clients and servers. It uses digital certificates and portable digital tokens (which store cryptographic keys and perform cryptographic operations.).


certificate

A form of electronic identification that enables a hierarchy of trust, depending on the identity of a user or computer. Certificates are used during the negotiation of a secure communication.


cryptography

The science of protecting the privacy of data by encoding the data so it is unreadable to anyone who doesn't have a secret key to decode it.


CPU utilization

A measurement of the average load on a computer's processor. As processor usage increases due to security tasks, users may notice slower performance. Intel PRO/100 S Management and Server Adapters are designed to offload the security overhead from Packet Protect by using a special on-board processor, thereby reducing processor utilization.


decryption

The un-encoding of encrypted data using a secret password or key.


default action

A security action containing a predefined set of proposals designed to inter-operate with other computers running Intel® Packet Protect or other IPSec implementations.


default behavior

The default behavior is like a rule, and is used when there is no rule that specifies the workgroup containing the computer name/IP address you want to communicate with.

Each computer in a LAN that uses Packet Protect has one of three default behaviors:

•	Secure Responder – This behavior always initiates communications in the clear, but will respond securely if requested.

•	Secure Initiator – This behavior always attempts secure communication first. If negotiation fails, it will communicate in the clear.

•	Lockdown – This behavior always attempts secure communication first. If negotiation fails, it denies communication.

The default action determines the security method used.

The default behavior can be defined during the installation process or from the Security Tab.

Also see Default Rule.


default rule

Exists when Packet Protect is first installed. The default rule is designed as the basic rule for secure communications between two computers where no specific rule has been defined. In order for the default rule to behave in this way, it must be defined as the last rule in a policy containing multiple rules. The default rule is defined with the default action.

If there is no default rule, the Default Behavior will be used.


DES

Data Encryption Standard. An encryption standard used to protect data confidentiality by encoding the data before it travels on a network. DES uses 40-bit, 56-bit, and 168-bit keys to encrypt data (168-bit keys are most often called 3DES).

Packet Protect supports 56-bit DES and 168-bit 3DES. (3DES is available worldwide except where prohibited by U.S. import/export restrictions.)


destination workgroup

A logical collection of computers (servers and clients) that you define using Packet Protect. Destination workgroups contain lists of computers with which another computer may want to communicate using Packet Protect.

Destination workgroups in Packet Protect are different from workgroups in Windows operating systems.


Diffie-Hellman

A method of securely sharing a secret key between two computers.


DNS

Domain Name Server. The network of Domain Name Servers that resolve fully qualified domain names (FQDNs) to their corresponding IP addresses.


encryption

The process of protecting data confidentiality by encoding the data so it is unreadable to anyone who doesn’t have the secret key to decode it. You can read data if it isn’t encrypted, but you can’t read data while it’s encrypted.


ESP

Encapsulation Security Payload. A method of protecting the confidentiality and/or integrity of data. ESP can be used to protect data confidentiality by encrypting the data using DES or 3DES. ESP can also be used to verify the origination of data by authenticating the data using MD5 or SHA-1.


fallback action

This is the defined course of action when secure negotiations fail between two computers. The fallback action can either allow communication without security or deny communication. This is defined in the If Rule Fails field in the Edit Rule dialog box.


FQDN

Fully Qualified Domain Name. It is the unique name given to a computer or device. When addressing information or requests, it’s often easier to remember a fully qualified domain name rather than an IP address. Because computers communicate using IP addresses, DNS software matches the fully qualified domain name to its corresponding IP address so users can communicate using the domain name and the IP address.


ICMP

Internet Control Message Protocol. A type of IP protocol used to transmit data that typically contains error or explanatory information. For example, the ping command uses ICMP to transmit data about network connectivity.


IETF

Internet Engineering Task Force. The organization that is developing and standardizing IKE and IPSec.


IKE

Internet Key Exchange. A standards-based protocol used to verify the identity of computers and negotiate a protected communication. IKE is a subset profile of ISAKMP/Oakley. It is being developed by the Internet Engineering Task Force (IETF).


intruder

An unwanted visitor from inside or outside your company who may try to steal information or harm your network.


IP

Internet Protocol. A set of rules that describe how computers transmit data with a destination address.


IP Address

A series of numbers that identifies a connection point or device on an IP network. Each connection point and device needs a unique IP address to communicate using IP. For example, 192.168.1.1 is a sample IP address.


IPSec

Internet Protocol (IP) Security. A set of protocols used to help secure the exchange of IP data. IPSec is being developed by the Internet Engineering Task Force (IETF).


key

A set of bytes that encrypt or decrypt data. Keys allow you to protect data from being read by an intruder on the network. There are two types of keys: public and private.


lockdown

A description of a default behavior for a computer that uses Packet Protect. A Lockdown computer initiates and replies to all communications by requesting security; it only communicates using IPSec (requires that the other computer also uses IPSec). A common use for this setting is a server that requires very restricted access.


MD5

Message Digest Algorithm. An algorithm often used to verify the integrity of packets traveling on a network. The algorithm transforms any number of bytes into a fixed number of bytes; no other set of bytes produces the same result.


network

One or more computers that are connected together for communication purposes.


packet

A piece of data that travels on the network. Each packet contains the data being transmitted, along with a destination address. Packet Protect protects packets as they travel on the network using IPSec.


perfect forward secrecy

The generation of an additional key pair to be used during data transfer. This helps guarantee that no keys are re-used. Using perfect forward secrecy increases protection, but generates more CPU utilization during security negotiation.


Public Key Infrastructure (PKI)

A system of digital certificates, certificate authorities, and other registration authorities that verify and authenticate the validity of each party involved in a secure communication, using public key cryptography.


policy

A collection of security settings and rules that are applied to a group of computers.


port

A connection point used by IP applications. For example, a Web server typically sends and receives information on port 80.


pre-shared key

A secret password that a computer presents to help verify its identity. Pre-shared keys are used during negotiation of a secure communication. Each computer must present the same pre-shared key in order to communicate using IPSec.


private key

A secret key that is known only by the computer to which it belongs. A computer uses its private key to decrypt data it receives.

For example, if a client wants to send data to a server, the workstation sends the data encrypted using the server’s public key. The server receives the data and uses its private key to decrypt the data.


3DES

Triple Data Encryption Standard, or Triple DES. An encryption standard used to encode data while it travels on a network. 3DES uses 168-bit keys to encrypt data. It is the strongest key available using DES, which provides the most protection for data confidentiality.

3DES is available worldwide except where prohibited by U.S. import/export restrictions.


workgroup

A logical collection of computers (servers and clients) that you define in Packet Protect.

Workgroups in Packet Protect are different from workgroups in Windows operating systems.


traffic

Packets traveling on the network.


SHA-1

Secure Hash Algorithm. An algorithm often used to verify the integrity of packets traveling on a network. The algorithm transforms any number of bytes into a fixed number of bytes; no other set of bytes produces the same result.


security association lifetime

The duration of a security association. A lifetime can be limited by time or by the amount of data transmitted.


security association

A protected connection between two computers. While the security association is active (8 hours is the default), the two computers can send data without re-negotiating a communication (as long as the data being sent uses a protocol defined in the existing security association).


security action

A collection of IPSec settings that are proposed when two computers attempt to communicate. Packet Protect uses security actions when a rule is matched for a communication. Packet Protect contains three predefined security actions: Default Action, Allow Communication Without Security, and Deny Communication.


secure responder

A description of a default behavior for a computer that uses Packet Protect. A Secure Responder computer initiates communications without security ("in the clear"), but can respond to communication requests with security. A common use for this setting is a workstation.


secure initiator

A description of a default behavior for a computer that uses Packet Protect. A Secure Initiator computer initiates communications by requesting security. If the negotiation fails, a Secure Initiator will communicate without security, or "in the clear." A common use for this setting is a server that doesn’t require the strict control of the Lockdown setting.


rule

A definition of the security settings to apply when a computer communicates with a destination computer using a specified protocol. A rule consists of a defined or default time limit (4-8 hours) and one or more security proposals.


root certificate

A signing certificate that is self-signed. It represents a key pair that is used to sign certificates; a root certificate is not signed by another signing certificate.


public key

A key that a computer shares with other computers it wants to communicate with in a protected manner. The other computers use the public key to encrypt data before sending it. For example, if a workstation wants to send data to a server, the workstation sends the data encrypted using the server’s public key. (The server receives the data and uses its private key to decrypt the data.)


protocol

A set of guidelines that describe how networks or applications communicate. If the set of rules are followed, information can be processed correctly. This allows computers and hardware devices to communicate with one another even if they’re different from one another.


offload

The assignment of algorithm computations from software to hardware. Packet Protect offloads security tasks to Intel PRO/100 S Management and Server adapters to speed processing and increase network performance.


LAN

Local Area Network. A communications network usually located within a building or small number of buildings. For example, computers and printers at many companies are connected to a LAN.


TCP

Transmission Control Protocol. TCP is a connection-oriented IP protocol that ensures that packets are received in the same order that they were sent. It also implements flow control, which ensures that the destination is not bombarded with packets.


UDP

User Datagram Protocol. UDP is a connectionless IP protocol. Unlike TCP, UDP provides very few error recovery services, offering instead a direct way to send and receive datagrams over an IP network. It's used primarily for broadcasting messages over a network.


Security tab

Use this window to view or edit the default security behavior for this computer and to access other Packet Protect features.

A System Administrator normally creates security settings for computers in a LAN. If you have questions about your security settings, contact your systems administrator.

System Policy

The information in this section defines the default security settings for this computer.

When two computers want to communicate securely, they attempt to negotiate a security action by matching proposals in the security action. If the computers cannot find a matching proposal, then the computers will apply the fallback action.

During installation, you set up basic security settings for the computer. These settings are the authentication method and the default behavior for that computer.

Authentication

Every computer's default security settings has a pre-shared key.

Pre-shared Key for Authentication. Type a key in the space provided. For computers to communicate securely, they must have the same pre-shared key. (NOTE: This is not available when access to the Policy Manager is enabled.)

Behavior

Each computer in the LAN selects a default security behavior. The default behavior is used if there are no matching rules in the System Policy when two computers attempt to negotiate a security association. (NOTE: This is not available when access to the Policy Manager is enabled.)

Secure Responder. Choose this behavior if you want this computer to initiate communication without security (sometimes called "in the clear"). This setting is often used for workstations in a LAN. Tell me more.

Secure Initiator. Choose this behavior if you want this computer to request security for all communications, but to not require it. This setting is often used for servers. Tell me more.

Lockdown. Choose this behavior if you want this computer to require security for all communications. This setting is used for servers that require strict security. Tell me more

Recreate default rule button

Use this button to delete the rules associated with the current policy and restore the Packet Protect default rule to this computer. (NOTE: This is not available when access to the Policy Manager is enabled.)

Event Logger Settings

Select the check box if you want Packet Protect to log events in your operating system's log file. This information may be useful for troubleshooting. Tell me more.

Advanced button

Click to open the Policy Editor, where you can manage a policy and its associated policy. (NOTE: This is disabled when access to the Policy Manager is enabled.)


Security tab Related Tasks

To View the Packet Protect Log

To View the Windows NT Event Log


About Secure Responders

Computers that are Secure Responders initiate communication without security, or in the clear. However, these computers can attempt to negotiate a secure communication if one is requested. For example, if a Secure Responder workstation attempts to access a file server and that file server requests a secure communication, the workstation can respond in a secure manner.

If two workstations are configured as Secure Responders and they attempt to communicate with each other, the communication is allowed without security, or in the clear. Also, Secure Responders and computers that are not Packet Protect-enabled can communicate without security.

NOTE:

If Packet Protect finds message traffic that matches a rule, the rule is evaluated first, then the system behaves as a secure initiator or lockdown, depending on the fallback action of the rule. This behavior applies to the default rule as well.


About Secure Initiators

Computers that are Secure Initiators request security for all communications but do not require it. For example, a Secure Initiator server always initiates communications by requesting security. If the negotiation for a secure communication is unsuccessful, the Secure Initiator communicates without security, or in the clear.


About Lockdown

Computers that have chosen Lockdown behavior require security for all communication. Lockdown computers do not communicate without security, that is, they do not communicate in the clear.

Use Lockdown only if a computer will be accessed by a very limited number of computers, and those computers are all properly set up with Packet Protect. If a backup to another computer is scheduled automatically, the backup will fail unless the other computer is also security-enabled.


Security Exceptions tab

Use the Security Exceptions tab window to view or edit a list of ports that must be open to allow necessary unprotected communications, and to specify a list of ports that you wish to deny communications.

This table shows some commonly used security exceptions that can be used.

About this Window

The following information is shown for each port:

Protocol. The protocol used for this communication. Valid protocols are UDP. and TCP.

Local. The port number that is open on the originating, or local, computer for this communication.

Remote.  The port number that is open on the receiving, or remote, computer for this communication.

Access. Either Allow Communication without Security or Deny Communication between the two ports listed.

Buttons

Add. Click to add a special security action to the list.

Edit. Click to modify a special security action that you select from the list.

Remove. Click to remove the selected security action from the list.

Note:

Packet Protect will not let you enter a duplicate or overlapping security exception to the list.  (An overlapping security action has a port definition that matches a previously defined one, and uses the term "any" to define the second port.) You will receive an error message if your create an exception that uses the same protocol, local port, and remote port as another security exception.

For example:

You have already defined a security exception that allows communication without security for the UDP protocol, with the local port set to 600 and the remote port set to 601.

If you then add another security exception with the local port set to 600 and the remote port set to ANY, this new security exception overlaps the previous security exception, because the remote port 601 belongs to ANY port. And if the action is set to deny communication for the UDP protocol, the new exception will be in conflict with the previously defined exception and will not be added.

However, if you add a security exception that denies communication for UDP, with the local port set to 600 and the remote port set to 600, there is no overlap and this security exception will be added to your list.


Common Security Exceptions

Protocol	Local Port	Remote Port	Action
UDP	68	67	Allow Communication without Security DHCP
UDP	137	137	Allow Communication without Security NetBios Name
UDP	138	138	Allow Communication without Security NetBios Datagram
UDP	Any	53	Allow Communication without Security NetBios Session
UDP	500	500	Allow Communication without Security
TCP	Any	53	Allow Communication without Security DNS
UDP	Any	53	Allow Communication without Security DNS
UDP	Any	389	Allow Communication without Security LDAP Access


Security Exceptions tab related topics

Add a Security Exception

Edit a Security Exception

Delete a Security Exception

Common Security Exceptions


Policy Editor

Use the Policy Editor to manage all aspects of a policy.

With Policy Editor you can:

•	Change the order that rules are applied in for a policy

•	Create a new rule for a policy

•	Edit an existing rule

•	Delete a rule

About this window

Apply Rules in order of preference

All of the rules in the system policy are listed, arranged in order that the rules are applied.

Rule Name. The name of this rule.

Destination Workgroup. The name of the workgroup that you will be communicating with when you use this rule.

Security Action. The security action that will be taken when this rule is performed. You can customize the security action to have more than one proposal.

Buttons

New Rule. Click to create a new rule to apply to this policy.

Edit Rule. Click to edit a rule that you have selected from the list of rules for this policy.

Delete Rule. Click to delete the rule that you have selected from this policy.

Caution:

When you delete a rule, the rule is completely removed from your computer. If you want to use it again, you will have to create it again.

Move Up. Click to move the selected rule up in the list of the order the rules are applied in.

Move Down. Click to move the selected rule down in the list of the order the rules are applied in.


New Rule

Use the New Rule dialog box to create a new rule in your system policy.

About this window

Rule Name. Type a name for this rule.

Destination Workgroup. Choose the destination workgroup for this rule from the drop-down list. You can create new destination workgroups, edit existing destination workgroups, or delete a destination workgroup.

Security Action. Choose the security action for this rule. You can create new security actions, edit existing security actions, or delete a security action.

If rule fails. Choose a fallback security action to perform if this rule fails. The choices are Allow Communication Without Security and Deny Communication.

Security Action Authentication

Select an authentication method to use for this rule.

Use system policy settings. Choose this option to use the same method that is used by the system policy.

Use custom settings.  Choose this option to select a different authentication method.

Propose Certificate. This option proposes using a certificate. If you choose this option, the initiator and the responder must both be configured to use the same type of certificate.

Propose pre-shared key. Choose this option to propose using a pre-shared key. If you choose this option, the initiator and responder(s) must type the same pre-shared key in the space provided.

Buttons

Customize Destination. Choose to add or change information about the destination workgroup.

Customize Security. Choose to add or change information about a security action.


Edit Rule

Use the Edit Rule dialog box to edit a rule in your system policy.

About this window

Rule Name. Displays the name of the rule that you selected on the Policy Editor.

Destination Workgroup. Displays the destination workgroup chosen for this rule from the drop-down list.

Security Action. Displays the security action chosen for this rule from the drop-down list.

If rule fails. Displays a fallback security action to perform if this rule fails. The choices are Allow Communication without Security and Deny Communication.

Security Action Authentication

Displays the security action chosen for this rule.

Use system policy settings. If selected, this option uses the same authentication method that is used by the system policy.

Use custom settings.  If selected, this option uses a different authentication method from the system policy.

Propose Certificate. This option proposes using a certificate. If you choose this option, the initiator and the responder must both be configured to use the same type of certificate.

Propose pre-shared key. This option proposes using a pre-shared key. If you choose this option, the initiator and responder(s) must type the same pre-shared key in the space provided.

Buttons

Customize Destination. Choose to add or change information about the destination workgroup.

Customize Security. Choose to add or change information about a security action.


Customize Destination Workgroups

Use this window to manage the list of destination workgroups. You can create a new workgroup, edit a workgroup, or delete an existing workgroup.

About this window

Destination Workgroup

A drop-down list of all existing destination workgroups. The value that is currently displayed when you click OK will be the destination workgroup name used in the Edit Rule and New Rule dialog boxes.

Add computers by

A drop-down list that lets you select how you want name computers: by name or by IP address.

Computer name/IP Address

A text box where you can type the name of a computer or an IP address (the label for the text box reflects the selection made in the Add computers by drop-down list).

Computers in this workgroup

A list that contains the computers in the selected workgroup.

Buttons

New. Click New to create a new destination workgroup.

Delete. Click Delete to delete the destination workgroup that is selected.

Add >>. Click Add to move a computer (by name or by IP address) from the Name text box into the Computers in this workgroup list.

<< Remove. Click Remove to delete a computer that you selected from the Computers in this workgroup list.


To Create a New Rule

Begin on the Packet Protect Security tab.

1.	Click Advanced.

2.	Click New Rule.

3.	Type a name for the new rule. Refer to Naming Conventions for information about naming a rule.

4.	For Destination Workgroup, use the drop-down list to a pre-defined workgroup that will be used for this rule. You cannot type the name of a workgroup. Choose Customize Destination to add or change workgroup information.

5.	For Security Action, use the drop-down list to select a pre-defined security action for this rule. You cannot type the name of a security action. Choose Customize Security to add or change a security action.

6.	Using the drop-down list, select an action to perform if the rule fails. You can choose to Allow Communication without Security or Deny Communication.

7.	Choose a rule authentication method. Select Use System Policy Settings to use the setting of the default behavior. Select Use custom settings to propose another authentication method.

8.	If you select Use custom settings, choose either Propose Certificate or Proposed pre-shared key. If you choose pre-shared key, type the key password in the space provided.


To Edit an Existing Rule

Begin on the Packet Protect Security tab.

1.	Click Advanced.

2.	Select the rule you want to edit.

3.	Click Edit Rule.

4.	To change the Destination Workgroup, use the drop-down list to a pre-defined workgroup that will be used for this rule. All other workgroups will be denied access. You cannot type the name of a workgroup. Choose Customize Destination to add or change workgroup information.

5.	To change Security Action, use the drop-down list to select a pre-defined security action for this rule. You cannot type the name of a security action. Choose Customize Security to add or change a security action.

6.	Using the drop-down list, select an action to perform if the rule fails. You can choose to Allow Communication without Security or Deny Communication.

7.	Choose a rule authentication method. Select Use System Policy Settings to use the setting of the default behavior. Select Use custom settings to propose another authentication method.

8.	If you select Use Custom Settings, choose either Propose Certificate or Proposed pre-shared key. If you choose pre-shared key, type the key password in the space provided.


To Delete a Rule

1.	On the Security tab, click Advanced.

2.	In the Packet Protect Policy Editor, select a rule to delete.

3.	Click Delete Rule.

4.	Click OK.


Event Logging

Events that are significant to Packet Protect running on Windows NT* are stored in the NT Event Log. Use the NT Event Viewer to view the log entries.

On Windows 98 systems, these entries are stored in the Packet Protect Log.


To Create a New Security Action

1.	On the Security tab, click Advanced.

2.	Click New Rule or select an existing rule and click Edit Rule.

3.	Click Customize Security.

4.	Click New.

5.	Type the name of the new security action in the Security Action box.

6.	Specify a value each of the following item:

Time Limit

•	Use the check box to determine whether to set a time limit for the security association when using this security action.

•	Set the length of time that this security action can be used (range is 4 to 8 hours).

Perfect forward secrecy

•	Use the check box to determine if you want to use perfect forward secrecy for this security action.

7.	Create a proposal to use with this security action.

A proposal is built using three different methods: encryption, ESP authentication, and AH authentication.  At least one of these methods must be used in any proposal.

Encryption

•	Use the drop-down list to choose an encryption method (or no encryption method at all).

ESP authentication

•	Use the drop-down list to choose a method for the Encapsulation Security Payload authentication, which actually includes authentication and encryption,  (or no ESP authentication at all).

 AH authentication

•	Use the drop-menu to choose a method for Authentication Header authentication (or no AH authentication at all).

8.	Click Add>> to add a proposal to the list of proposals used with this security action.

9.	Repeat steps 7 and 8 for each of the proposal you want to add.

10.	Use the Move Up and Move Down buttons to select the order in which the proposals will be run.  Select a proposal and use the buttons to promote or demote it in the list.

11.	When you are finished specifying the security action, click OK.


To Edit an Existing Security Action

1.	On the Security tab, click Advanced.

2.	Select an existing rule and click Edit Rule.

3.	Click Customize Security.

4.	In the Security action box, use the drop-down list to select a security action.

5.	Modify the security action:

Time Limit

•	Use the check box to determine whether to set a time limit for the security association when using this security action.

•	Set or change the length of time that this security action can be used (range is 4 to 8 hours).

Perfect forward secrecy

•	Use the check box to determine if you want to use perfect forward secrecy for this security action.

6.	Create a proposal to use with this security action. Or, select one from the list to edit it.

A proposal is built using three different methods: encryption, ESP authentication, and AH authentication.  At least one of these methods must be used in any proposal.

Encryption

•	Use the drop-down list to choose an encryption method (or no encryption method at all).

ESP authentication

•	Use the drop-down list to choose a method for the Encapsulation Security Payload authentication (or no ESP authentication at all).

 AH authentication

•	Use the drop-menu to choose a method for Authentication Header authentication (or no AH authentication at all).

7.	Click Add>> to add a proposal to the list of proposals used with this security action

8.	Repeat steps 6 and 7 for each of the proposals you want to add or edit.

9.	Click <<Remove to delete a proposal from the list. A security action must have at least one proposal.

10.	Use the Move Up and Move Down buttons to select the order in which the proposals will be run.  Select a proposal and use the buttons to promote or demote it in the list.

11.	When you have made your changes to the security action, click OK.


To Create a Destination Workgroup

Begin at the Edit Rule or New Rule dialog box.

1.	Click Customize Destination.

2.	Click New.

3.	In the Destination Workgroup box, type the name for the new workgroup. Refer to Naming Conventions for rules about naming a destination workgroup.

4.	Use the Add computers by drop-down list to select a method for adding computers to this workgroup: by IP Address or by Computer Name.

5.	Type either a computer name or IP address in the box.

6.	Click Add>> to add this computer to the Computers in this workgroup. You can click <<Remove to remove a computer from the list.

7.	Repeat steps 5 and 6 to add any remaining computers to the workgroup.

8.	When you have finished adding computers to the workgroup, click OK.


To Edit an Existing Destination Workgroup

1.	On the Edit Rule or New Rule dialog box, click Customize Destination.

2.	In the Destination workgroup text box, use the drop-down list to select a workgroup.

3.	To add a new computer to the workgroup, use the drop-down list to select a method for adding computers to the workgroup: by IP address or by name. Then, type a computer name or IP address in the box. Click Add>>.

4.	To remove a computer from the workgroup, select the name or IP address in the Computers in this workgroup list. Then, click <<Remove.

When you are finishing adding and removing computers from this workgroup, click OK.

Note:

Refer to Naming Conventions for rules for the naming of destination workgroups.


To Delete a Destination Workgroup

1.	On the Edit Rule or New Rule dialog box, click Customize Destination.

2.	In the Destination workgroup text box, use the drop-down list to select a workgroup.

3.	Click Delete.


About Destination Workgroups

A destination workgroup is a collection of computers with which your computer communicates.

For example, if your organization's security strategy requires specific security settings when you communicate with computers in the Research and Development group, your policy must include a rule, with those security settings, that specifies a Research and Development workgroup as the destination workgroup. Likewise, the computers in the Research and Development workgroup must have a rule that specifies the same security settings and has your computer in the destination workgroup.

Initially, Packet Protect is installed with one workgroup: Everybody. You can create other workgroups as needed for your organization.

"Myself" is a reserved workgroup name used to refer to your computer.

Note:

Packet Protect workgroups are completely separate from Windows NT* workgroups.

If Policy Manager access is enabled on your computer, you will not be able to view or update information about destination workgroups.


About Destination Workgroups related topics

Create a Destination Workgroup

Edit an Existing Destination Workgroup

Delete an Existing Destination Workgroup

Naming Conventions


About Security Actions

Note:

If Policy Manager access is enabled on your computer, you will not be able to view or update information about the System Policy.

A security action is a collection of security settings that are used in a rule. For each rule, there is a destination workgroup, a security action, and a fallback action to perform if the rule fails for any reason.

A security action can be used for more than one rule at a time. However, a single rule can only have one security action.

The settings in a security action define a number of parameters that comprise the action. These include:

•	Security action limitations

Every security action can optionally specify a limitation to how long the security action can be used. Limitations can be set by time (for example, 6 hours). The range is 4-8 hours, with 8 hours as the default. A few minutes before the time limit is reached, security is re-negotiated between the two computers, and the newly negotiated security association takes over.

In general, the shorter the amount of time that a particular security action is in effect, the more secure the security association is. However, very small time limits for a security action require more negotiations, which can affect performance on the network.

When two computers are negotiating security actions with different time limits, the lowest limit is used. For example, if Computer A had a time limit of 4 hours, and Computer B had a time limit of 6 hours, then the security association would end at the 4-hour limit.

Unless specified differently, the default time limit of 8 hours is used.

•	Perfect forward secrecy

When this setting is selected, the system proposes a second set of keys for the security association. In this instance, the first set of keys is used only to verify identification.

•	Security Proposals

A security proposal may have one algorithm or a combination of 2 or 3 algorithms. An algorithm combination can contain security settings for encryption, ESP authentication (which includes encryption as well as authentication), and AH authentication.

When two computers wish to communicate securely, they must be able to agree on a proposal.

When a security action has more than one proposal, you indicate the order of preference. Generally, you may want to move the proposals with the highest degree of security towards the top of list and the proposals with the least degree of security towards the bottom of the list.


About Security Action related topics

Customize Security Actions dialog box

About Security Algorithms

Creating a Security Action

Editing an Existing Security Action

Naming Conventions


About Rules

A rule defines the action for a security association. The System Policy can have one or more rules or no rules at all. Each rule defines how you want to communicate with other computers on the network.

When Packet Protect is installed, the Default Rule is created for that computer's System Policy. However, you can delete the Default Rule if you wish. Other rules can be added, edited, or deleted as needed.

A rule consists of the following elements:

1. Name. Each rule in the policy has a name. The rule that Packet Protect creates is named "Default rule." When you create additional rules, you give them a unique name. More Information.

2. Destination workgroup. This is a group of one or more computers that you want to use with this rule. Once a destination workgroup is defined, it can be used by any rule in the System Policy.

3. Security action. A security action is a collection of security settings that is used by two computers when they attempt to negotiate secure communications.  LAN administrators define security actions.

4. Fallback action. When a security association cannot be negotiated, the fallback action specified in "If Rule Fails field" is applied. Fallback actions are:

•	Allow Communication without Security

•	Deny Communication.

5. Authentication. The authentication can be rule-specific. You can use a pre-shared key or a certificate.

Note:

If Policy Manager access is enabled on your computer, you will not be able to view or update information about rules.


About Rules related topics

About Policies

Policy Editor dialog box

About Security Actions

About Destination Workgroups

Naming Conventions


About Policies

Every computer using Packet Protect has one and only one policy, called the System Policy.

A policy can contain one or more rules, or no rules at all.

When a policy has more than one rule, the order of the rules is important. Generally, rules should be ordered from the most specific to the least specific.


About Policies related topics

About Rules

About Security Actions

Policy Editor dialog box


To Delete an Existing Security Action

1.	On the Security tab, click Advanced.

2.	Click Customize Security.

3.	Use the drop-down list in the Security action box to select a security action.

4.	Click Delete.


Getting Started

Welcome to Intel® Packet Protect.

Packet Protect enables computers on a LAN to protect the confidentiality and authenticity of IP traffic. Packet Protect uses the industry standard IPSec, a collection of  protocols for Internet Protocol security, and IKE (the Internet Key Exchange) to protect information when it is traveling between computers.

About Online Help

The online help for packet protect provides:

•	Instructions for performing Packet Protect tasks

•	Descriptions of the dialog boxes used in Packet Protect

•	Overviews of security concepts used in Packet Protect

Using Help

The online help can be viewed anytime you are using a Packet Protect dialog box. Click Help to view information specifically about the dialog box you are viewing. Once you start help, there are several ways to use the Packet Protect online help.

1.	Many help topics have a [image] button. Click this button to view a list of topics related to the topic you are viewing.

2.	Special security terms used by Packet Protect are defined. Terms with definitions are green and underlined, as in this example. When you click on one of these terms, you can read the definition in a pop-up window.

3.	If you want a printout of a topic, click the Print button. The help file you are viewing will be sent to your default Windows printer.

4.	To look at topics that you've already looked at, click the Back button.

5.	The online help has a table of contents. To help you access help from any help window, click the Help Topics button to view the Packet Protect Help Contents window. Click on any of these tabs:

•	Contents. Presents a list of the topics in Packet Protect Online Help. The [image] symbol indicates a single topic. If you click on it, another window displays that topic. The [image] symbol contains a list of topics that are associated with label on the book. If you click on a book, a list of topics that you can choose from displays.

•	Index. Presents a list of keywords in the Packet Protect Online Help. You can scroll through the list, or you can enter a term in the box and the Index will try to find that word in the index. When you select a word in the index, you can display the help topic(s) associated with that term.

•	Find. Contains a list of all the words in the online help. If you can't find the information you want in the Contents or the Index, you can probably locate it here. When you select a word in the list, you can display the help topic(s) associated with that term.

For more information

Detailed information about Packet Protect is available in the Packet Protect Online User's Guide, located in the \Info\Protect folder on the Intel CD


Getting Started related topics

Security tab

About Policies

Packet Protect User's Guide


About Packet Protect

Developed by Intel Corporation, Packet Protect is a security program that provides confidentiality and authentication for communications between computers on a LAN.

Computers enabled with Packet Protect use a System Policy to negotiate secure communications between them. A policy contains rules which govern how secure communications are accomplished between two computers.  These rules contain exactly one security action, as well as a fall-back action if the security actions fail. If you choose not to use any rules in your System Policy, your default behavior will be used to govern secure communications.

For detailed information about Packet Protect and security concepts, refer to the Intel ® Packet Protect Online User's Guide, located in the \Info\Protect folder on the Intel CD.


System Requirements

To run Packet Protect, the computer must meet the following requirements:

•	Windows* NT 4.0 with Service Pack 5 or 6a (or higher) or Windows* 98 (Retail version with Service Pack 1 or Second Edition).

•	DCOM98, v1.3 or later (included with Windows 98). Also can be downloaded at http://www.microsoft.com/com/dcom/dcom98/download.asp.

•	KMPAPI32.DLL (NT4 only). This file comes from the Entrust* Engelligence* installation. If you see an error message regarding this DLL during installation, see the README.TXT file (in the \PktPt\NT4\ directory) for remedial steps.

•	40 MB of available space on the hard disk

•	32 MB of RAM minimum, 64 MB recommended

•	200 MHz  Pentium®   processor performance level or higher (recommended)

•	A member of the Intel® PRO/100 adapter family. (An Intel PRO/100 S adapter is required for offloading certain security processing to the adapter.)


Packet Protect

Developed by the Intel Corporation, Packet Protect is a security program based on IPSec protocols that provides confidentiality and authentication for communications between computers that share a LAN.


To view the Windows NT Event Log

1.	Select Start > Programs > Administrative Tools > Event Viewer. A list of all NT events, including Packet Protect events, are listed.

2.	Double-click on an event to view the log.

Notes:

In Windows NT, Packet Protect events are stored in the NT Event Log.

In Windows 98, Packet Protect events are stored in the Packet Protect Log.


Event Logging related topics

Viewing  the Windows NT Event Log

Viewing the Packet Protect Log


Legal

Copyright © 2000, Intel Corporation. All rights reserved.

Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR   97124-6497  USA

Intel Corporation assumes no responsibility for errors or omissions in this document. Nor does Intel make any commitment to update the information contained herein.

* Other product and corporate names may be trademarks of other companies and are used only for explanation and to the owners' benefit, without intent to infringe.


other software
Other Software Products

* Other brands, names, or trademarks are the property of their respective owners companies and are used only for explanation and to the owners' benefit, without intent to infringe.


Add a Security Exception

Use this window to create a special security action  to be applied to ports that you specify.

Protocol. Select either UDP or TCP.

Action. Select either Allow Communication without Security or Deny Communication.

Local port(s). Used to specify the port or ports that initiate communications. Select either Any Port or Port. If you choose Port, type a port number in the box.

Remote port(s). Used to specify the port or ports that initiate communications. Select either Any Port or Port. If you choose Port, type a port number in the box.


Add Security Exception related topics

Add a New Security Exception

Security Exceptions tab

Edit a Security Exception


Edit Security Exception

Use this window to modify a special security action that you selected on the Security Exceptions tab.

Protocol. Select either UDP or TCP.

Action. Select either Allow Communication without Security or Deny Communication.

Local port(s). Used to specify the port or ports that initiate communications. Select either Any Port or Port. If you choose Port, type a port number in the box.

Remote port(s). Used to specify the port or ports that initiate communications. Select either Any Port or Port. If you choose Port, type a port number in the box.


Edit Security Exception related topics

Add a New Security Exception

About destination workgroups

Security Exceptions tab


Certificate tab

Use the Certificate tab to view information about the certificate that is installed on your computer.

Notes:

Certificates are only available on the Windows NT platform.

If you do not have any certificates installed, this tab is not visible.

Certificate provider. The name of the company that provided this certificate.

Reference. Displays the path to the profile that is associated with this certificate.

Subject Name. The name of the person to whom this certificate was issued.

CA Name. The name of the certificate authority that issued this certificate. The certificate authority is not necessarily the same as the certificate provider.

Issued on. The date when the public key certificate was issued.

Expires on. The date when this public key certificate expires. NOTE: The private key (used to sign certificates) may expire sooner than the public key. Check with your certificate authority administrator for the details on private key expiration.

ISAKMP addresses. ISAKMP (Internet Security Association and Key Management Protocol) addresses identify the location and identity of the holder of this certificate. Up to three types of addresses can be used, but only one is required. They are:

E-mail address. The e-mail address for the person who has this certificate.

FQDN. The domain name of this machine that has the certificate installed on it.

IP Address. The address of the machine that has the certificate installed on it.


Certificate tab Related Task

Install a Certificate


To Install a Certficate
To Install a Certificate

Before you can install and use a certificate, you must have already installed and configured the security software that was provided by the certificate provider. Contact your network administrator if you have any questions about your computer and certificate support.

1.	Insert the Intel CD in your CD-ROM drive.

2.	Use Windows Explorer or My Computer to navigate to D:\PktPt\NT4\Cert, where D is the letter for your CD-ROM drive.

3.	Double-click Setup.exe.

4.	Follow the prompts to install the certificate.


Support Tab

Use the Support tab to find out where you can get support for Packet Protect. This window contains URLs for Intel customer support, as well as information about Intel network products.

This windows also displays information about this version of Packet Protect.


Policy Manager tab

Use the Policy Manager tab window to enable or disable policy management support access to your computer by the Policy Manager.

The Policy Manager is a computer on your network that stores and distributes (or "push") security policies to Packet Protect-enabled computers.

You must specify whether you want to allow access to the Policy Manager. If you enable Policy Manager access, then you must specify the following information:

•	Policy Manager name or IP Address. Type either the FQDN (Fully Qualified Domain Name) or IP address that identifies the Policy Manager computer.

•	Policy Manager Port Number. Type the port number on the Policy Manager computer. This port number is used when it distributes security policies to your computer. The default value for the Policy Manager Port Number is 4000. Port numbers must be between 1024 and 65535.

•	Push Port Number. Type the number of the port on your computer to be used for Policy Manager access. The default value for the Push Port Number is 4001. Port numbers must be between 1024 and 65535.

For more information about Intel NetStructure Policy Manager, click here.


Policy Manager tab Related Task

Enable Intel NetStructure Policy Manager


To Enable Intel NetStructure Policy Manager

1.	On the Policy Manager tab, select the Enable Policy Access option.

2.	Enter the domain name or IP address of the Policy Manager computer.

3.	Enter the Policy Manager Port Number. The default port number is 4000; do not change this number unless you are instructed to.

4.	Enter the Push Port Number. The default port number is 4001; do not change this number unless you are instructed to.

5.	Click OK.

For more information about Intel NetStructure Policy Manager, click here.


To view the Packet Protect Log

Using Windows Explorer, navigate to Program Files > Packet Protect > Log.

The Log folder can contain up to 50 log files. Older files are deleted as new events are placed in the log. Use Notepad to open and read these files.


Packet Protect Logging

You can ask Packet Protect to keep a log of Packet Protect events for your computer. These logs can be used to help you troubleshoot any problems that occur when you use Packet Protect.

For detailed information about Packet Protect log files, including a list of possible log entries and their significance, refer to the Packet Protect User's Guide.


Packet Protect Logging related topics

Enable Logging of Packet Protect Events

View the Packet Protect Log

View the Windows NT Event Log

Packet Protect User's Guide


To Add a New Security Exception
To Add a Security Exception

1.	On the Security Exceptions tab, click Add.

2.	In the Protocol box, use the drop-down list to select a protocol for this security exception--either the UDP or TCP protocol.

3.	In the Action box, use the drop-down list to select an action for this security exception--either Allow Communication without Security or Deny Communication.

4.	In Local port(s), choose either Any Port or Port. If you choose port, type the number of the local port (broadcast is always sent with no security).

5.	In Remote port(s), choose either Any Port or Port. If you choose port, type the number of the port that receives communication for this special security exception.

6.	Click OK.


Intel Policy Manager
Intel® NetStructure™ Policy Manager

The Intel NetStructure Policy Manager can be used to automatically deploy Packet Protect rules and policy defaults to computers.  If your LAN uses a Policy Manager, you will not have to set up or maintain any of the rules that Packet Protect uses on your computer. Instead, the Policy Manager will create, or "push," rules on your computer as needed.

If your computer is enabled with the Policy Manager, you will not see some of the dialog boxes and tasks described in Help.  You will see an explanatory note, such as:

Note:

If Policy Manager access is enabled on your computer, you will not be able to view or update information about the System Policy.


To Edit a Security Exception

1.	On the Security Exceptions tab, select the security exception you want to edit and click Edit.

2.	Change any of these settings:

Protocol. Select either UDP or TCP.

Action. Select either Allow Communication without Security or Deny Communication.

Local port(s). Used to specify the port or ports that initiate communications. Select either Any Port or Port. If you choose Port, type a port number in the box.

Remote port(s). Used to specify the port or ports that initiate communications. Select either Any Port or Port. If you choose Port, type a port number in the box.

3.	Click Protocol. Select either UDP or TCP.


To Delete a Security Exception

1.	On the Security Exceptions tab, select the security exception you want to delete.

2.	Click Remove.


Note for Policy Manager-enabled Computers

Computers that are enabled with Intel® NetStructure™ Policy Manager do not use the tasks in this section. The only exception is for Viewing the Packet Protect Log and Viewing the Windows NT Event Log. The Policy Manager takes care of all other security tasks.

For more information about Policy Manager, click here.


To Enable Logging of Packet Protect Events

On the Security tab, click Mark this box to log Packet Protect events.

In Windows 98 systems, all Packet Protect events are written to the Packet Protect Log.

In Windows NT systems, events are written to the Windows NT Event Log.


Naming Conventions

Generally, you can name rules and destination workgroups anything you want, as long as you remember a few rules:

•	Names are not case-sensitive. You can use upper-case letters if you like, but the computer won't care if you type it that way or not.  So, "Name" is the same as "name" or "NAME."

•	You can not use the name "Myself" for a workgroup; this word is reserved.

•	Names can contain up to 100 characters.

•	Names cannot contain these special characters: "," (comma) or "~" (tilde).


About the Packet Protect User's Guide

Intel Packet Protect, in addition to the online help that you are now using, has a User's Guide. The Packet Protect User's Guide contains information on many kinds of topics, including:

•	Installation instructions

•	Deployment strategies

•	Understanding how Packet Protect and IPSec work

•	Configuring Packet Protect

•	Maintaining Packet Protect

The Packet Protect User's Guide is located on the Intel CD. You can view the guide from the Intel CD:

Insert the Intel CD in your CD-ROM drive and select Info > Protect > index.htm.

When you open the User's Guide, you can choose to copy the User's Guide to your hard drive by clicking that option on the index page. Once you have copied the guide to your hard drive, you can open the manual using the Program Group: Start > Programs > Intel Packet Protect > Guide. The files are located at C:\ PRO100Guide\Protect.