Sun Cluster Geographic Edition System Administration Guide

ProcedureHow to Configure IPsec for Secure Cluster Communication

In the Sun Cluster Geographic Edition infrastructure, the hostname of a logical host is identical to the cluster name. The logical hostname is a special HA resource. You must set up a number of IP addresses for various Sun Cluster Geographic Edition components, depending on your cluster configuration.

On each partner cluster, you must configure encryption and authorization for exchanging inbound and outbound packets from a physical node to the logical-hostname addresses. The values for the IPsec configuration parameters on these addresses must be consistent between partner clusters.

IPsec uses two configuration files:

The following procedure configures a cluster, cluster-paris, for IPsec secure communication with another cluster, cluster-newyork. Both clusters are running the Solaris OS 9 release. The procedure assumes that the local logical hostname on cluster-paris is lh-paris-1 and that the remote logical hostname is lh-newyork-1. Inbound messages are sent to lh-paris-1 and outbound messages are sent to lh-newyork-1.

Use the following procedure on each node of cluster-paris.

  1. Log in to the first node of the primary cluster, phys-paris-1, as superuser.

    For a reminder of which node is phys-paris-1, see Example Sun Cluster Geographic Edition Cluster Configuration.

  2. Set up an entry for the local address and remote address in the IPsec policy file.

    The policy file is located at /etc/inet/ipsecinit.conf. Permissions on this file should be 644. For more information about this file, see the ipsecconf(1M) man page.

    For information about the names and values that are supported by Sun Cluster Geographic Edition software, see Appendix B, Legal Names and Values of Sun Cluster Geographic Edition Entities.

    1. Configure the communication policy.

      The default port for the tcp_udp plug-in is 2084. You can specify this value in the /etc/opt/SUNWcacao/modules/com.sun.cluster.agent.geocontrol.xml file.

      The following command configures a policy with no preference for authorization or encryption algorithms.

      # {raddr lh-newyork-1 rport 2084} ipsec {auth_algs any encr_algs any \
      sa shared} {laddr lh-paris-1 lport 2084} ipsec {auth_algs any encr_algs \
      any sa shared}

      When you configure the communication policy on the secondary cluster, cluster-newyork, you must reverse the policies.

      # {laddr lh-newyork-1 lport 2084} ipsec {auth_algs any encr_algs \
      any sa shared} {raddr lh-paris-1 rport 2084} ipsec {auth_algs any encr_algs \
      any sa shared}
    2. Add the policy by rebooting the node or by running the following command.

      # ipsecconf -a /etc/inet/ipsecinit.conf
  3. Set up encryption and authentication keys for inbound and outbound communication.

    The communication file is located at /etc/init/secret/ipseckeys. Permissions on the file should be 600.

    Add keys:

    # ipseckey -f /etc/init/secret/ipseckeys

    Key entries have the following general format:

    # inbound to cluster-paris
    add esp spi <paris-encr-spi> dst lh-paris-1 encr_alg <paris-encr-algorithm> \
    encrkey <paris-encrkey-value>
    add ah spi <newyork-auth-spi> dst lh-paris-1 auth_alg <paris-auth-algorith> \
    authkey <paris-authkey-value>
    # outbound to cluster-newyork
    add esp spi <newyork-encr-spi> dst lh-newyork-1 encr_alg \
    <newyork-encr-algorithm> encrkey <newyork-encrkey-value>
    add ah spi <newyork-auth-spi> dst lh-newyork-1 auth_alg \
    <newyork-auth-algorithm> authkey <newyork-authkey-value>

    For more information about the communication files, see the ipsecconf(1M) man page.