Authentication between Maestro Orchestrators

[SomAustrianCity]

Hi

According to the R82 Scalable Platforms Administration Guide, it is possible to activate Authentication between Maestro Orchestrators. I'd like to do this (after i upgrade from R81.20), because the site-sync is realized over a DWDM-Darkfibre connection. And i fear at some point, some auditor will ask if this connection is plain text or not - and then i can answer "Of course not. What kind of Admin do you think i am?". (Maybe not this exact wording 😉)

But in the guide states:

To avoid synchronization issues between Orchestrators, do not configure Security Groups before making sure all Orchestrators are authenticated

Now, my environment is in production. I can't just delete my SGs in order to facititate that. Has anyone activated this feature with existing SGs? Is there a problem?

Or is it more of a warning? If someone would change a configuration or for some reason something should fail over, then there can be a split-brain situation or something similar?

Thanks for any advice,

Christian

Some more infos:

Starting in R82, you can configure mutual authentication between all Maestro Orchestrators on your Maestro Sites to make sure their communication is secure and encrypted over Internal Sync ports (sync in the same Maestro Site) and External Sync ports (sync between Maestro Sites).

This authentication is based on SSH keys and SSL certificates. These SSL certificates are valid for one year. Orchestrators renew these SSL certificates automatically.

This authentication is a two-way mesh process - each Orchestrator authenticates all other Orchestrators.

[Martijn · Accepted solution]

Hi,

I have upgraded several Maestro Orchestrator appliances from R81.10 / R81.20 to R82 that are in production with Security Groups. The upgrade of the Orchestrators to R82 went without any issues. The same for the hotfix installation.

After the upgrade I activated authentication between the Orchestrators and did not notice anything strange on the Security Groups. Also no issues with network traffic through the Security Group where reported.

I would make sure the basics are OK.

Are the Orchestrators in sync?
Do they have the correct side ID?
Do they have the correct Orchestrator ID?
Check with lldpctl on both Orchestrators

If you are not sure, perform the action in a service window.

Regards,
Martijn
 

[emmap]

As Martijn says, after the upgrade you can set up the authentication without affecting your security groups. There's a new button in the Orchestrator > Security Group section of the WebUI to look at it. Make sure the date and time are right on your MHOs before you upgrade them, I have seen MHOs that still think it's 2010 be upgraded and end up creating certificates that are already expired.

[SomAustrianCity]

Thanks for your answers guys 🙂
This makes me more confident that it will work