Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Example: Encrypt Messages Between Two Nodes in a Chassis Cluster

This topic explains the procedure for enabling encryption on security devices.

The procedure explains how to optionally configure the control link to encrypt messages exchanged between two nodes in a chassis cluster. When enabled, this configuration secures inter-node communication by using an internally configured IPsec Security Association (SA).

By encrypting the control-link traffic, the chassis cluster ensures that control messages and login-related communications between nodes are protected against unauthorized access, thereby providing a more secure operational environment.

When the internal IPsec SA is configured, IPsec-based rlogin and remote command (rcmd) are enforced so that attackers cannot gain privileged access or observe traffic containing administrator commands and outputs.

You do not need to configure the internal IPsec SA on both nodes because the nodes are synchronized when the configuration is committed.

  1. To enable control link encryption in chassis cluster, run the following commands:

    The only supported encryption algorithm is 3des-cbc and the key must be exactly 24 bytes long, otherwise the configuration will result in commit failure.

  2. Commit the configuration.

    After the settings have been configured correctly and committed, a reboot would be required for the feature to take effect.

  3. View the configuration of control link encryption before reboot and after reboot.

Related Documentation