Overview
XDR security spans three domains: encryption of data in transit across the replication link, access control over who can initiate potentially destructive failover operations, and credential isolation between sites using token-based authentication.Prerequisites
- Administrator credentials with the
dr-adminrole - TLS certificates provisioned for site-to-site communication
- Identity and access management configured in XDeploy
Replication Encryption
All replication traffic between primary and DR sites is encrypted in transit.TLS configuration
TLS configuration
Configure encryption in Disaster Recovery → Sites → Replication Links → [Link] → Security:
Verify the current TLS configuration from Disaster Recovery → Sites → Replication Links → [Link] → Security.
| Setting | Recommended Value |
|---|---|
| Protocol | TLS 1.3 minimum (TLS 1.2 allowed for legacy compatibility) |
| Certificate source | Managed by XDeploy (auto-renewed 30 days before expiry) |
| Authentication | Mutual TLS — both sites authenticate each other |
| Cipher suites | XDeploy defaults (AES-256-GCM, ChaCha20-Poly1305) |
Certificate management
Certificate management
XDeploy manages site certificates automatically. Certificates are:
- Issued per-site at registration time
- Automatically renewed 30 days before expiry
- Rotated without interrupting active replication
| Setting | Value |
|---|---|
| Condition | xdr_cert_days_to_expiry < 30 |
| Severity | Warning |
| Channel | ops-alerts |
Encryption at rest
Encryption at rest
Replicated data at rest on the DR site is encrypted using the same storage
encryption policy as the primary site. Configure encryption at rest in XSDS
at the pool or volume level — XDR inherits the encryption status of the
source volumes.See XSDS Admin — Security for storage
encryption configuration.
RBAC Access Control
XDR operations are governed by Xloud identity roles. Failover and failback are potentially disruptive operations — restrict them to trained personnel.| Role | Permissions |
|---|---|
dr-viewer | View plan status, replication lag, test reports, and site health |
dr-operator | Create and manage protection plans; run DR tests; initiate failover and failback |
dr-admin | Full access including site registration, replication link configuration, and compliance report export |
Assigning DR Roles
- Dashboard
- CLI
Navigate to Identity → Projects → [Project] → Members and assign the
appropriate DR role to each user. DR roles apply at the project level —
a user must have a DR role in both the primary and DR site projects to
operate across sites.
Site Token Management
XDR agents authenticate between sites using site-specific tokens, not user credentials. This isolates site-to-site authentication from user identity management.Token Lifecycle
| Event | Action Required |
|---|---|
| Initial deployment | Token generated by XDeploy during site registration |
| Scheduled rotation | Rotate via the Dashboard on schedule (recommended: quarterly) |
| Suspected compromise | Rotate immediately; review access logs |
| Token expiry | 90-day expiry by default; configurable at registration |
- View token status: Displays token expiry date and current validity for all registered sites
- Rotate token: Click Rotate Token to generate a new authentication token
- Update peer: After rotation, navigate to the peer site configuration and enter the new token
Token rotation does not interrupt active replication. The old token remains valid
for 15 minutes after rotation to allow the update to propagate before the old
token is invalidated.
Audit Logging
XDR records all administrative actions and failover events in an immutable audit log.| Event Category | Logged Information |
|---|---|
| Site registration / deregistration | Admin user, timestamp, site details |
| Plan creation / modification | Admin user, timestamp, changed fields |
| Failover initiated | Operator user, timestamp, trigger type (manual/automatic), recovery point |
| Failback initiated | Operator user, timestamp |
| DR test started / completed | Operator user, timestamp, outcome |
| Token rotation | Admin user, timestamp, affected site |
- Filter by event type (failover, failback, test, site registration, token rotation)
- Set date range for the reporting period
- Export as PDF or CSV for compliance submissions
Network Security
| Requirement | Implementation |
|---|---|
| Dedicated replication VLAN | Separate replication traffic from production networks |
| Firewall rules | Open only required ports (TCP 7000–7002) between site CIDRs |
| No internet exposure | Replication endpoints should not be reachable from the public internet |
| VPN / MPLS | Use a dedicated circuit rather than the public internet for the replication link |
Next Steps
Replication Configuration
Configure replication link encryption and bandwidth settings
Compliance
Export audit logs for compliance reporting
XSDS Admin — Security
Configure storage encryption that XDR inherits
Identity & Access Admin Guide
Manage Xloud RBAC roles and identity federation