close

keyboard_arrow_left

Table of Contents Expand all

play_arrow Overview
- play_arrow Understanding Contrail Controller
  - Contrail Overview
  - Contrail Description
play_arrow Installing and Upgrading Contrail
- play_arrow Supported Platforms and Server Requirements
  - Server Requirements and Supported Platforms
- play_arrow Installing Contrail and Provisioning Roles
- play_arrow Installation and Configuration Scenarios
- play_arrow Upgrading Contrail Software
  - Contrail In-Service Software Upgrade from Releases 3.2 and 4.1 to 5.0.x using Ansible Deployer
  - Contrail In-Service Software Upgrade from Releases 3.2 and 4.1 to 5.0.x using Helm Deployer
- play_arrow Backup and Restore Contrail Software
  - Backing up Contrail Databases in JSON Format
- play_arrow Multicloud Contrail
- play_arrow Using Contrail with Kubernetes
- play_arrow Using VMware vCenter with Containerized Contrail
- play_arrow Using Contrail with Red Hat
  - Deploying Contrail with Red Hat OpenStack Platform Director 13
  - Provisioning Red Hat OpenShift Container Platform Clusters Using Ansible Deployer
- play_arrow Contrail and AppFormix Kolla/Ocata OpenStack Deployment
- play_arrow Using Contrail with Juju Charms
  - Deploying Contrail by Using Juju Charms
- play_arrow Contrail Command
- play_arrow Extending Contrail to Physical Routers, Bare Metal Servers, Switches, and Interfaces
- play_arrow Contrail for Data Center Automation and Fabric Management
play_arrow Configuring Contrail
- play_arrow Configuring Virtual Networks
- play_arrow Example of Deploying a Multi-Tier Web Application Using Contrail
  - Example: Deploying a Multi-Tier Web Application
  - Sample Network Configuration for Devices for Simple Tiered Web Application
- play_arrow Configuring Services
- play_arrow Configuring Service Chaining
- play_arrow Examples: Configuring Service Chaining
- play_arrow Adding Physical Network Functions in Service Chains
  - Using Physical Network Functions in Contrail Service Chains
  - Example: Adding a Physical Network Function Device to a Service Chain
- play_arrow QoS Support in Contrail
  - Quality of Service in Contrail
  - Configuring Network QoS Parameters
- play_arrow BGP as a Service
  - BGP as a Service
  - BGP as a Service in Contrail Release 3.1
- play_arrow Load Balancers
- play_arrow Optimizing Contrail
play_arrow Contrail Security
- play_arrow Contrail Security
  - Security Policy Enhancements
play_arrow Monitoring and Troubleshooting Contrail
- play_arrow Configuring Traffic Mirroring to Monitor Network Traffic
- play_arrow Understanding Contrail Analytics
- play_arrow Configuring Contrail Analytics
- play_arrow Using Contrail Analytics to Monitor and Troubleshoot the Network
- play_arrow Common Support Answers
play_arrow Contrail Commands and APIs
- play_arrow Contrail Commands
- play_arrow Contrail Application Programming Interfaces (APIs)

list Table of Contents

English

Configuring Transport Layer Security-Based XMPP in Contrail

date_range 16-Oct-23

arrow_backward

arrow_forward

Overview: TLS-Based XMPP

Starting with Contrail 3.0, Transport Layer Security (TLS)-based XMPP can be used to secure all Extensible Messaging and Presence Protocol (XMPP)-based communication that occurs in the Contrail environment.

Secure XMPP is based on RFC 6120, Extensible Messaging and Presence Protocol (XMPP): Core.

TLS XMPP in Contrail

In the Contrail environment, the Transport Layer Security (TLS) protocol is used for certificate exchange, mutual authentication, and negotiating ciphers to secure the stream from potential tampering and eavesdropping.

The RFC 6120 highlights a basic stream message exchange format for TLS negotiation between an XMPP server and an XMPP client.

Note:

Simple Authentication and Security Layer (SASL) authentication is not supported in the Contrail environment.

Configuring XMPP Client and Server in Contrail

In the Contrail environment, XMPP based communications are used in client and server exchanges, between the compute node (as the XMPP client), and:

the control node (as the XMPP server)
the DNS server (as the XMPP server)

Configuring Control Node for XMPP Server
Configuring DNS Server for XMPP Server
Configuring Control Node for XMPP Client

Configuring Control Node for XMPP Server

To enable secure XMPP, the following parameters are configured at the XMPP server.

On the control node, enable the parameters in the configuration file: /etc/contrail/contrail-control.conf.

Parameter	Description	Default
`xmpp_server_cert`	Path to the node's public certificate	`/etc/contrail/ssl/certs/server.pem`
`xmpp_server_key`	Path to server's or node's private key	`/etc/contrail/ssl/private/server-privkey.pem`
`xmpp_ca_cert`	Path to CA certificate	`/etc/contrail/ssl/certs/ca-cert.pem`
`xmpp_auth_enable=true`	Enables SSL based XMPP	Default is set to false, XMPP is disabled. Note: The keyword `true` is case sensitive.

Configuring DNS Server for XMPP Server

To enable secure XMPP, the following parameters are configured at the XMPP DNS server.

On the DNS server control node, enable the parameters in the configuration file:/etc/contrail/contrail-control.conf

Parameter	Description	Default
`xmpp_server_cert`	Path to the node's public certificate	`/etc/contrail/ssl/certs/server.pem`
`xmpp_server_key`	Path to server's/node's private key	`/etc/contrail/ssl/certs/server-privkey.pem`
`xmpp_ca_cert`	Path to CA certificate	`/etc/contrail/ssl/certs/ca-cert.pem`
`xmpp_dns_auth_enable=true`	Enables SSL based XMPP	Default is set to false, XMPP is disabled. Note: The keyword `true` is case sensitive.

Configuring Control Node for XMPP Client

To enable secure XMPP, the following parameters are configured at the XMPP client.

On the compute node, enable the parameters in the configuration file: /etc/contrail/contrail-vrouter-agent.conf

Parameter	Description	Default
`xmpp_server_cert`	Path to the node's public certificate	`/etc/contrail/ssl/certs/server.pem`
`xmpp_server_key`	Path to server's/node's private key	`/etc/contrail/ssl/private/server-privkey.pem`
`xmpp_ca_cert`	Path to CA certificate	`/etc/contrail/ssl/certs/ca-cert.pem`
`xmpp_auth_enable=true xmpp_dns_auth_enable=true`	Enables SSL based XMPP	Default is set to false, XMPP is disabled. Note: The keyword `true` is case sensitive.

arrow_backward PREVIOUS Configuring Virtual Networks for Hub-and-Spoke Topology

NEXT arrow_forward Configuring Graceful Restart and Long-lived Graceful Restart

Contrail Feature Guide

ON THIS PAGE