You can enforce security between the PCE (Path Computation Element) server and Path
Computation Clients (PCC) by configuring
a
security mode for the
PCEP connections. Routing Director supports the following security
modes:
- Auto Detect—Accepts PCEP connection regardless of whether you have security enabled or
not.
- Strict Disable—Accepts only non-secured PCEP connections.
- Strict Enable—Enforces security on all PCEP sessions. If a device does not have security
enabled, its connection is rejected.
To enforce security between the PCE server and PCC using Paragon Shell:
-
Log in to a cluster node. You are logged in to Paragon Shell.
-
Type configure to enter configuration mode.
user@node>
user@node> configure
Entering configuration mode
[edit]
user@node#
-
By default, the security mode is strict-disable. Set the
pce_server_global_default_tls_mode parameter to
auto-detect or strict-enable so that the PCEP
security is enabled.
user@node# set paragon cluster applications pathfinder pce-server pce-server-global-default-tls-mode strict-enable
Note:
You can update the pce_server_global_default_tls_mode parameter
before or after installing Routing Director.
-
If you enable secured connections (auto-detect or
strict-enable), you can
use
either
system-generated certificates or custom certificates.
If you are using system-generated certificate:
Note:
System-generated certificates are managed by cert-manager, which automatically renews
certificates 90 days before their expiration. The PCE server seamlessly detects the
updated certificate, ensuring that existing PCEP sessions remain uninterrupted while
continuing to operate securely.
If you are using custom certificates for added security, use the following steps to
upload a custom certificate:
-
Set the use_custom_certificate parameter to
true.
user@node# set paragon cluster applications pathfinder use_custom_certificate true
-
Upload the custom certificate and the private key in the
/root/epic/config folder of the node from which
the
cluster is deployed.
user@node# set paragon cluster applications pathfinder pce-server pce-server-user-certificate pce-server-custom-certificate-filename certificate_filename
user@node# set paragon cluster applications pathfinder pce-server pce-server-user-certificate pce-server-custom-certificate-key-filename certificate_private_key
-
You can view the custom certificate using the following command:
user@node# kubectl get secrets | grep pce-custom-cert
Note: Custom certificates are not automatically renewed. You need to
upload the renewed server certificate and private key at least a few days before the
expiry of the certificate.
-
Commit and quit configuration mode.
user@node# commit and-quit
commit complete
Exiting configuration mode
user@node>
-
Copy the certificate
on
the device using the following procedure:
-
Type exit from Paragon Shell to exit to the Linux root shell.
-
If you are
using a system-generated certificate,
download
the certificate using the following command:
user@node:~#kubectl get secret -n northstar pce-default-cert -o jsonpath='{.data.ca\.crt}' | base64 -d > ns1.pem
-
Upload the
certificate
(system-generated or custom) to the device using the following
command:
user@node:~#scp ns1.pem root@device-IP-address:/tmp
-
Log
in to the device
to
configure and
commit the following:
user@device# set security pki ca-profile pccd-tls ca-identity pccd-tls
user@device# set security pki ca-profile pccd-tls revocation-check disable
user@device# commit and-quit
-
Load the copied certificate file.
user@device> request security pki ca-certificate load ca-profile pccd-tls filename /tmp/ns1.pem
Fingerprint:
34:3a:cf:3e:9e:5a:fb:89:e5:53:15:75:79:b1:31:6a:e3:ed:77:55 (sha1)
2a:23:48:70:b7:ad:db:c7:5b:dc:58:e5:16:71:aa:da (md5)
:83:66:f1:6e:55:15:59:ad:a9:60:07:0a:08:0a:f7:f2:2f:90:53:1a:65:81:ed:09:87:2c:ce:3b:31:d5:f9 (sha256)
Do you want to load this CA certificate ? [yes,no] (no) yes
-
Configure the PCEP mode and commit the configuration.
user@device# set protocols pcep tls-strict
user@device# commit and-quit
-
Delete certificate authority (CA) digital certificates from the device.
user@device> clear security pki ca-certificate ca-profile pccd-tls
-
Do one of the following:
-
If you have not installed Routing director, run the following commands to configure
the PCE
server
based on the pce_server_global_default_tls_mode setting:
user@node> request paragon config
user@node> request paragon deploy cluster
-
If you have already installed Routing director, run the following commands to
redeploy only the PCE server component:
user@node> request paragon config
user@node> request paragon deploy cluster input "-t addon-apps -e target_components=pceserver"
The PCEP Status column on the Device tab of the Topology page (Observability
> Network ) is displayed as Up if you have enabled PCEP
security and have uploaded certificates on both the server and the client.
If you encounter issues, such as a PCEP session is down, ensure that you:
