Secure peering 编辑

Which Citrix SD-WAN WANOP features required secure peering?

You need to establish secure peering between Citrix SD-WAN WANOP appliances at two ends of the link when you intend to use any of the following features:

• SSL compression

• Signed CIFS support

• Encrypted MAPI support

Do I need to consider anything before configuring a secure tunnel?

Yes. You must order and receive a crypto license before you can configure a secure tunnel between the Citrix SD-WAN WANOP appliances at to ends of the link.

What happens when you enable secure peering on an appliance at one end of the link?

When you enable secure peering on a Citrix SD-WAN WANOP appliance at one end of the link, the other appliance detects it and attempts to open an SSL signaling tunnel. If the two appliances successfully authenticate each other over this tunnel, the appliances have a secure peering relationship. All accelerated connections between the two appliances are encrypted, and compression is enabled.

What happens when I do not enable secure peering on the partner appliance?

When an appliance has secure peering enabled, connections with a partner for which it does not have a secure peer relationship are not encrypted or compressed, though TCP flow-control acceleration is still available. Compression is disabled to ensure that data stored in compression history from secured partners cannot be shared with unsecured partners.

Why do I need a keystore password?

You need a keystore password to access the security parameters. This password is different from the administrator’s password and allows security administration to be separated from other tasks. If the keystore password is reset, all existing encrypted data and private keys are lost.

To protect data even if the appliance is stolen, the keystore password must be reentered every time the appliance is restarted. Until this is done, secure peering and compression are disabled.

Does the Citrix SD-WAN WANOP appliance I received from Citrix contain keys and certificate to set up secure tunnel?

No. Citrix SD-WAN WANOP products are shipped without the required keys and certificates for the SSL signaling tunnel. You must generate them yourself.