Citrix SD-WAN WANOP

Secure peering

March 12, 2021

Contributed by:

S C

Which Citrix SD-WAN WANOP features required secure peering?

You need to establish secure peering between Citrix SD-WAN WANOP appliances at two ends of the link when you intend to use any of the following features:

SSL compression
Signed CIFS support
Encrypted MAPI support

Do I need to consider anything before configuring a secure tunnel?

Yes. You must order and receive a crypto license before you can configure a secure tunnel between the Citrix SD-WAN WANOP appliances at to ends of the link.

What happens when you enable secure peering on an appliance at one end of the link?

When you enable secure peering on a Citrix SD-WAN WANOP appliance at one end of the link, the other appliance detects it and attempts to open an SSL signaling tunnel. If the two appliances successfully authenticate each other over this tunnel, the appliances have a secure peering relationship. All accelerated connections between the two appliances are encrypted, and compression is enabled.

What happens when I do not enable secure peering on the partner appliance?

When an appliance has secure peering enabled, connections with a partner for which it does not have a secure peer relationship are not encrypted or compressed, though TCP flow-control acceleration is still available. Compression is disabled to ensure that data stored in compression history from secured partners cannot be shared with unsecured partners.

Why do I need a keystore password?

You need a keystore password to access the security parameters. This password is different from the administrator’s password and allows security administration to be separated from other tasks. If the keystore password is reset, all existing encrypted data and private keys are lost.

To protect data even if the appliance is stolen, the keystore password must be reentered every time the appliance is restarted. Until this is done, secure peering and compression are disabled.

Does the Citrix SD-WAN WANOP appliance I received from Citrix contain keys and certificate to set up secure tunnel?

No. Citrix SD-WAN WANOP products are shipped without the required keys and certificates for the SSL signaling tunnel. You must generate them yourself.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Secure peering

March 12, 2021

Contributed by:

S C

March 12, 2021

Contributed by:

S C

Secure peering

In this article