You can enforce security between the PCE (Path Computation Element) server and Path
Computation Clients (PCC) by configuring a security mode for the PCEP connections.
Routing Director supports the following security modes:
- Auto Detect—Accepts PCEP connection regardless of whether you have security
enabled or not.
- Strict Disable—Accepts only non-secured PCEP connections.
- Strict Enable—Enforces security on all PCEP sessions. If a device does not have
security enabled, its connection is rejected.
To enforce security between the PCE server and PCC using
Deployment
Shell:
-
Log in to a cluster node. You are logged in to
Deployment
Shell.
-
Type configure to enter configuration mode.
user@node>
user@node> configure
Entering configuration mode
[edit]
user@node#
-
By default, the security mode is strict-disable. Set the
pce_server_global_default_tls_mode parameter to
auto-detect or strict-enable so that
the PCEP security is enabled.
user@node# set deployment cluster applications pathfinder pce-server pce-server-global-default-tls-mode strict-enable
Note:
You can update the
pce_server_global_default_tls_mode parameter
before or after installing Routing Director.
-
If you enable secured connections (auto-detect or
strict-enable), you can use either system-generated
certificates or custom certificates.
If you are using system-generated certificate:
Note:
System-generated certificates are managed by cert-manager, which
automatically renews certificates 90 days before their expiration. The
PCE server seamlessly detects the updated certificate, ensuring that
existing PCEP sessions remain uninterrupted while continuing to operate
securely.
If you are using custom certificates for added security, use the following
steps to upload a custom certificate:
-
Set the use_custom_certificate parameter to
true.
user@node# set deployment cluster applications pathfinder use_custom_certificate true
-
Upload the custom certificate and the private key in the
/root/epic/config folder of the node from which
the cluster is deployed.
user@node# set deployment cluster applications pathfinder pce-server pce-server-user-certificate pce-server-custom-certificate-filename certificate_filename
user@node# set deployment cluster applications pathfinder pce-server pce-server-user-certificate pce-server-custom-certificate-key-filename certificate_private_key
-
You can view the custom certificate using the following command:
user@node# kubectl get secrets | grep pce-custom-cert
Note: Custom certificates are not automatically renewed.
You need to upload the renewed server certificate and private key at least a
few days before the expiry of the certificate.
-
Commit and quit configuration mode.
user@node# commit and-quit
commit complete
Exiting configuration mode
user@node>
-
Copy the certificate on the device using the following procedure:
-
Type exit from
Deployment
Shell to exit to the Linux root shell.
-
If you are using a system-generated certificate, download the
certificate using the following command:
user@node:~#kubectl get secret -n northstar pce-default-cert -o jsonpath='{.data.ca\.crt}' | base64 -d > ns1.pem
-
Upload the certificate (system-generated or custom) to the device using
the following command:
user@node:~#scp ns1.pem root@device-IP-address:/tmp
-
Log in to the device to configure and commit the following:
user@device# set security pki ca-profile pccd-tls ca-identity pccd-tls
user@device# set security pki ca-profile pccd-tls revocation-check disable
user@device# commit and-quit
-
Load the copied certificate file.
user@device> request security pki ca-certificate load ca-profile pccd-tls filename /tmp/ns1.pem
Fingerprint:
34:3a:cf:3e:9e:5a:fb:89:e5:53:15:75:79:b1:31:6a:e3:ed:77:55 (sha1)
2a:23:48:70:b7:ad:db:c7:5b:dc:58:e5:16:71:aa:da (md5)
:83:66:f1:6e:55:15:59:ad:a9:60:07:0a:08:0a:f7:f2:2f:90:53:1a:65:81:ed:09:87:2c:ce:3b:31:d5:f9 (sha256)
Do you want to load this CA certificate ? [yes,no] (no) yes
-
Configure the PCEP mode and commit the configuration.
user@device# set protocols pcep tls-strict
user@device# commit and-quit
-
Delete certificate authority (CA) digital certificates from the
device.
user@device> clear security pki ca-certificate ca-profile pccd-tls
-
Do one of the following:
-
If you have not installed Routing director, run the following commands
to configure the PCE server based on the
pce_server_global_default_tls_mode
setting:
user@node> request deployment config
user@node> request deployment deploy cluster
-
If you have already installed Routing director, run the following
commands to redeploy only the PCE server component:
user@node> request deployment config
user@node> request deployment deploy cluster input "-t addon-apps -e target_components=pceserver"
The PCEP Status column on the Device tab of the Topology page
(Observability > Network ) is displayed as
Up if you have enabled PCEP security and have uploaded
certificates on both the server and the client.
If you encounter issues, such as a PCEP session is down, ensure that you:
