Hot Standby Security
Overview
In hot standby networking, two devices synchronize configuration and entry information. Backup packets contain device configuration and service information, which attackers may intercept, tamper with, or replay. To ensure the security of the two devices, you are advised to take the following security hardening measures:
- Connect the heartbeat interfaces of the two devices directly so that backup packets will not pass through other devices, preventing backup packets from being tampered with or replayed.
- Configure encryption key that meets security requirements for HRP heartbeat link.
- Enable validity check for HRP packets.
HRP is a mechanism for encrypting backup packets before transferring them to prevent data leaks. The encryption function of the heartbeat link is disabled by default. After configuring the heartbeat link encryption key, enable this function.
- In the hot standby networking where the backup channel is directly connected, backup packets do not pass through the third-party device. Therefore, there is no risk of information leakage. In this case, you can disable the encryption function of the backup channel.
- If the backup channel is not directly connected, you are advised to configure the backup channel encryption function. You are advised to regularly (at least once every 90 days) change the encryption key of the heartbeat link to prevent the key from being leaked.
Impact on the System
Two devices with inconsistent security hardening configurations cannot form a hot standby group.
Procedure
- Configure an authentication key for HRP packets.
system-view hrp encryption-key key
- You need to configure the key on both the active and standby devices. Ensure that the keys on the two devices are the same. Otherwise, backup between the devices may fail.
- For security purposes, the key must contain at least two of the following: uppercase letters (A to Z), lowercase letters (a to z), digits (0 to 9), and special characters (such as !, @, #, $, and %).
- Optional: Enable validity check for HRP packets.
hrp checksum enable