peer ssl-policy role

Usage Scenario

The Secure Sockets Layer (SSL) protocol protects data privacy on the Internet by preventing attackers from eavesdropping on data exchanged between a client and a server. Specifically, to ensure data transmission security on a network, a peer needs to be configured as an SSL client using the peer ssl-policy role client command or as a server using the peer ssl-policy role server command, and the SSL data encryption, identity authentication, and message integrity verification mechanisms need to be used.

Prerequisites

A BGP peer relationship has been established using the peer as-number command.

Precautions

A set SSL role (server or client) of a peer or peer group cannot be changed to another role unless you first run the peer ssl-policy role disable or undo peer ssl-policy role command to cancel the role configuration of the peer.

If a peer or peer group is configured as an SSL client, the peer listen-only command cannot be run. That is, the peer listen-only command is mutually exclusive with the peer ssl-policy role client command. If a peer or peer group is configured as an SSL server, the peer connect-only command cannot be run. That is, the peer connect-only command is mutually exclusive with the peer ssl-policy role client command.

The SSL role configuration for a peer takes precedence over that for a peer group to which the peer belongs.

SSL/TLS authentication takes effect only when SSL client and server roles are specified, SSL policies are applied to the client and server, and SSL/TLS authentication is enabled on the server (SSL/TLS authentication is not required on the client).