Sun Cluster Geographic Edition System Administration Guide

Configuring Secure Cluster Communication Using IPsec

You can use IP Security Architecture (IPsec) to configure secure communication between partner clusters. IPsec enables you to set policies that permit or require either secure datagram authentication, or actual data encryption, or both, between machines communicating by using IP. Consider using IPsec for the following cluster communications:

Sun Cluster software and Sun Cluster Geographic Edition software support IPsec by using only manual keys. Keys must be stored manually on the cluster nodes for each combination of server and client IP address. The keys must also be stored manually on each client.

Refer to the Part IV, IP Security, in System Administration Guide: IP Services for a full description of IPsec configuration parameters.

ProcedureHow to Configure IPsec for Secure Cluster Communication



IPsec uses two configuration files:


Use the following procedure on each node of cluster-paris.






    1. Configure the communication policy.

      The default port for the tcp_udp plug-in is 2084. You can specify this value in theetc/cacao/instances/default/modules/com.sun.cluster.geocontrol.xml file.


      any sa shared}


      any sa shared}

      # ipsecconf -a /etc/inet/ipsecinit.conf


    Add keys:

    # ipseckey -f /etc/init/secret/ipseckeys

    Key entries have the following general format:

    # inbound to cluster-paris
    add esp spi paris-encr-spi dst lh-paris-1 encr_alg paris-encr-algorithm \
    encrkey paris-encrkey-value
    add ah spi newyork-auth-spi dst lh-paris-1 auth_alg paris-auth-algorithm \
    authkey paris-authkey-value
    # outbound to cluster-newyork
    add esp spi newyork-encr-spi dst lh-newyork-1 encr_alg newyork-encr-algorithm \
    encrkey newyork-encrkey-value
    add ah spi newyork-auth-spi dst lh-newyork-1 auth_alg newyork-auth-algorithm \
    authkey newyork-authkey-value
