R80.30 - SecureXL CCP Encryption

[HeikoAnkenbrand]

Under R80.30 it is possible to encrypt CCP traffic.  This is very useful to protect the cluster from manipulated CCP packets.  Therefore new commands have been implemented on the CLI for this purpose. The following description shows you how to enable CCP encryption. All settings you make on the CLI are permanently stored in the following file “/etc/fw.boot/ha_boot.conf”.  This means that all settings are preserved after the reboot. You have to set the settings on both gateways and they will take effect on the fly. The CCP encryption is disabled by default and must be enabled via CLI on both gateways.

This command also shows the current status “on" or "off” of the CCP encryption on the cluster:

# cphaprob ccp_encrypt         

clish> show cluster members ccpenc

With this command you set the 32 byte long encryption and decryption key (blue) on both gateways:

# cphaconf ccp_encrypt_key aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

With the following command the encryption can be permanently enabled on the fly:

# cphaconf ccp_encrypt on

In this way the encryption can be disabled on the fly

# cphaconf ccp_encrypt off

As described above, all settings are saved in the file /etc/fw.boot/ha_boot.conf.

With this command you can test if the CCP encryption works. Here you should not see any cluster status information on the sync interface (blue). All packages should be visible under unknown when CCP encryption is enabled.

# tcpdump -nepi eth1 -x port -s 0 8116 2>/dev/null | ccp_analyzer -g –c

Unfortunately it is no longer possible to analyze the CCP packets via "ccp_analyzer " when encryption is enabled.

More interesting articles: cp.ankenbrand24.de