Intel(R) Packet Protect Software Supplemental Information
Version 3.0 for Windows* 98 and Windows Me*
=========================================================
NOTE: If you are using Windows NT*, open the readme.txt in the
\PktPt\NT4 directory. Additional information is in the Intel Packet
Protect User's Guide in the \Info\Protect directory on the product
CD-ROM.
Contents
========
- Overview
- System Requirements
- Installation
- Certificate Installation Issues
- Configuration
- Compatibility
- Security Exceptions for Communication
- Communicating with Windows 2000
- Other Known Issues
Overview
========
Intel Packet Protect is a departmental solution that helps protect
Internet Protocol (IP) traffic as it travels between computers on your
local area network (LAN). It protects data confidentiality and
authenticity, and helps prevent data from being retrieved by intruders
or hackers. Because many of the total data compromises are attempted
from within a company firewall, it is important to protect sensitive
data while it travels on your company's LAN.
Though Intel Packet Protect securely transmits traffic on the
network, it does not protect the data while it is stored on a
computer. Use your operating system features to provide access
control to sensitive areas of your network.
Intel Packet Protect uses Internet Key Exchange (IKE) and Internet
Protocol Security (IPSec) to protect communications on your LAN.
Both IKE and IPSec are protocol specifications being developed by the
Internet Engineering Task Force (IETF). Intel Packet Protect uses
pre-shared keys or certificates for IKE credential verification.
Intel Packet Protect supports only Entrust certificates.
Intel Packet Protect does not compress packets before they are sent
using IPSec.
System Requirements
===================
- Microsoft Windows* 98 or Windows Me*
- DCOM98, v1.3 or later. This can be downloaded at:
http://www.microsoft.com/com/dcom/dcom98/download.asp.
- KMPAPI32.DLL (only if certificate support is required). This file
comes from the Entrust* Engelligence* installation (see below).
- 40 MB minimum available hard disk space.
- 32 MB RAM minimum, 64 MB RAM recommended.
- 233 MHz Pentium(R) processor (performance level or better).
- Intel PRO/100 family of network adapters.
Installation
============
NOTE:
If you are upgrading from a prior version of Intel Packet Protect,
there are several steps which you must follow in order to
successfully upgrade. See "Installing Packet Protect" in the user
guide for complete information.
Configure PROSet II to enable IPSec:
-----------------------------------
1. Open PROSet II.
2. In the left pane, select Network Components.
3. Right-click on the name of the adapter you want to use.
4. Select Enable IPSec in the pop-up window.
5. Click OK. At this time the bindings are formed for IP
Security.
6. Type in your IP configuration information.
7. Re-start the system in order for the IPSec bindings to take
effect.
To install Intel Packet Protect:
-------------------------------
1. With the product CD inserted, browse to the CD-ROM using
Windows Explorer.
2. Double-click \PktPt\Win98\setup.exe.
3. Follow the prompts on the screen.
4. Re-start Windows when prompted.
Certificate Installation Issues
===============================
If you get a "Missing KMPAPI32.DLL" error message during Intel
Packet Protect certificate support installation, you will need to
download and install the Entrust* EntrustIPSec* Negotiator*
Toolkit:
1. Using your Internet web browser, go to http://www.entrust.com/
developer/ipsec/
2. Select "Download".
3. Enter your member ID and PIN if necessary.
4. Select a download location on your hard drive.
5. Using the Windows Explorer, find and run the EntrustIPSec
installer program.
6. After installation, go to the installation directory (default is
C:\Program Files\Entrust Toolkit\IPSec\Lib\) and move
"KMPAPI32.DLL" to the Windows system directory (the default is
C:\Windows\System\).
7. Re-start the Intel Packet Protect certificate support
installation.
Problems during Certificate Installation process:
------------------------------------------------
If you have problems logging in to Entrust/Entelligence, it may be
due to an improper setting in the Entrust .INI file:
1. Using a text editor, open /Winnt/entrust.ini
2. Locate the tag "FipsMode".
3. Set the value to "0" (zero).
4. Save and close the file.
If you get an error message, "Intel Packet Protect Credential
Store (CS) component problem: failed to get the subject name in the
certificate", it could be due to a duplicate conflicting profile
name. To resolve this, log out of Entrust/Entelligence, then start
up the Certificate Installer again.
Configuration
=============
When you install Intel Packet Protect on a computer, you set up basic
security settings the computer will apply to communication attempts.
Optionally, you may set up security policies to apply different
security settings to specific types of communication attempts. Refer
to the Intel Packet Protect User's Guide in the \Info\Protect folder
on the product CD-ROM for configuration details and deployment
examples.
Compatibility
=============
Intel Packet Protect is designed to offload encryption and
authentication tasks to Intel adapters that have an integrated
encryption co-processor, such as the PRO/100 S family of adapters.
LAN adapters that do not support offloading will still work but
system and network performance will not be optimal.
Intel Packet Protect is not supported on Intel PRO/1000 gigabit
adapters.
Intel Packet Protect does not support dial-up adapters.
Intel Packet Protect does not support IPSec tunnel mode.
Each computer that will communicate in a protected way using Intel
Packet Protect must use a pre-shared key or by using an Entrust
certificate.
Intel Packet Protect does not support the Kerberos authentication
method.
Intel Packet Protect computers can communicate with Windows 2000
IPSec computers by setting up each computer's policy to use the same
settings. You cannot use Intel Packet Protect to manage security
policies for Windows 2000 IPSec computers, or vice versa.
Compatibility with Mixed Versions of Intel Packet Protect
---------------------------------------------------------
Ideally, all computers should be running on the latest version
of Intel Packet Protect. See "Installing Packet Protect" in the
user guide for complete information.
If you continue using a previous versions of Intel Packet Protect
on one or more systems, note the following:
- You may experience performance problems.
- If you are using Entrust certificates for authentication,
machines running Intel Packet Protect version 2.x will not be
able to connect with the other machines. There is a patch
available for systems running Microsoft Windows NT. Download
it from http://support.intel.com, under "Downloads and Software".
Security Exceptions for Communication
=====================================
In order for a client machine running Intel Packet Protect to
communicate with a Domain Name Server (DNS) or a Windows Internet
Naming Service (WINS) server, you must employ one or more security
exceptions to allow communication. These and other security
exceptions are discussed in the Intel Packet Protect User Guide,
under the topic "Common Security Exceptions".
Communicating with Windows 2000
===============================
Intel Packet Protect 3.0 can communicate with the IPSec
implementation in Windows 2000, but there are two restrictions:
* Use the "All IP Traffic" protocol filter
* Use a matching preshared key
Use the "All IP Traffic" Protocol Filter
----------------------------------------
On Windows 2000, the rule used to communicate with Intel Packet
Protect clients must be set to "All IP Traffic" protocol filter, even
if you are only interested in specific protocols (e.g. TCP, UDP, etc)
on top of IP.
For example, if you are only interested in TCP communications between
Windows 2000 and Intel Packet Protect, you must create a new rule in
Windows 2000, which can communicate with the active rule or default
behavior on Intel Packet Protect. If you select TCP as the protocol
filter in the Windows 2000 rule, the communication may fail. You
MUST select "All IP Traffic" filter instead.
Use a Matching Pre-Shared Key
-----------------------------
Since all default rules in Windows 2000 use Kerberos for
authentication (not supported in Intel Packet Protect version 3.0),
you must either add a pre-shared key to the authentication methods in
the "All IP Traffic" default rule, or you must create a new rule with
"All IP Traffic" protocol filter AND a matching pre-shared key as one
of its authentication methods. This pre-shared key must match what
is in use with Intel Packet Protect.
Other Known Issues
==================
- During client startup, the client may communicate "in the clear"
for a few seconds, even though it may require protection. This
is because the computer is initiating itself on the network.
During this time period, the IP stack is open to IP-based network
intrusions.
- The Default Rule conflicts with Secure Responder behavior. Secure
Responders should initiate communication without security. However,
the Default Rule, if present, takes precedence over the Secure
Responder behavior and always initiates communication with
security. In this case, Secure Responders act like Secure
Initiators when the Default Rule is present. You can delete the
Default Rule. If you do, then Secure Responders will initiate
communications without security, or "in the clear."
- When you install certificate support on a computer, Intel Packet
Protect assumes that certificate software has already been installed
on that computer. The certificate installation will fail unless the
certificate software has been previously installed.
- When using the Default Rule, computers that operate as Secure
Responders will initiate communication with security and not in the
clear.
- Multicast traffic (defined as having an IP address between 224.0.0.0
and 239.255.255.255) and broadcast traffic will always be
transmitted in the clear and leave the system open to attacks from
intruders. The IPSec specification does not cover multicast and
broadcast packets, therefore these packets will neither be secured
nor filtered. The side effect is that the machine will still accept
packets from unauthenticated users. This may lead to a possible
misuse.
- Security exceptions and ports that are kept open allow traffic to
pass with no security. This leaves the system open to intruders.
- If you are installing on a non-English operating system which uses a
double-byte character set (e.g., Kanji), the directory path to the
executable files must be specified in ANSI text (e.g., English).
If there are any double-byte characters in the path, Intel Packet
Protect will not install properly.
- Some Windows 2000 versions are using DES policies instead of 3DES.
If the server has Intel Packet Protect installed, and the rule used
involve only 3DES (in various combinations) there will be no
communication between Windows 2000 clients and the Intel Packet
Protect server. To enable the use of 3DES you have to install the
Windows 2000 High Encryption Pack. This is available from the
Microsoft support site: http://www.microsoft.com/windows2000/
downloads/recommended/encryption/default.asp.
-------------------------------------------------------------
* Brand, name, or trademark or brand owned by another company.
Copyright (C) 2001, Intel Corporation.
Download Driver Pack
After your driver has been downloaded, follow these simple steps to install it.
Expand the archive file (if the download file is in zip or rar format).
If the expanded file has an .exe extension, double click it and follow the installation instructions.
Otherwise, open Device Manager by right-clicking the Start menu and selecting Device Manager.
Find the device and model you want to update in the device list.
Double-click on it to open the Properties dialog box.
From the Properties dialog box, select the Driver tab.
Click the Update Driver button, then follow the instructions.
Very important: You must reboot your system to ensure that any driver updates have taken effect.
For more help, visit our Driver Support section for step-by-step videos on how to install drivers for every file type.