World of EUC

You can still remove the check mark in secure.. If it works i don't know, i see no reason why you want to run it non-secure.

might take a week or so for networks to implement the firewall change to allow 3009 instead of 3011 and i got the firmware updates planned and approved for next couple days. We use private IP's for GSLB site ip's its not using public ips /internet for MEP traffic.  I did try untick secure RPC  on a test 12.1-62.25 instance and it threw up an error Argument pre-requisite missing [validateCert, secure==YES] hence why i am not sure you can go from secure to non secure on latest builds

I can try to test it, but i'm on a version 13.0-82.42 if you want me to.

Seems to work when you do it from the CLI.

`&gt; set rpcNode 192.168.0.241 -secure NO`
`Warning:  [Secure option for the rpcnode is set to 'OFF/NO'. It is recommended t                                                                                                                                                             o set it to 'ON/YES' for enhanced security.]`
 `Done`
`&gt; sh rpcNode 192.168.0.24`
`192.168.0.240 192.168.0.241`
`&gt; sh rpcNode 192.168.0.241`
`1)      IPAddress:  192.168.0.241`
        `Password:  0a44f1b2558ef3a79463a3bb4039c7728e59f8b50bd45a6f3bb48fc85ca8`
        `b2525b3bd12f63540955668b1b2e1ebbd25c SrcIP:  *`
        `Secure:  OFF             ValidateCert:  NO`

cool thanks i can update the firmware and then turn it off and then re enable when they do the firewall rules

image.png

confirmed via cli on test vpx instance it works and turns off. The GUI wouldn't let me turn it off

Is it a historical reason that there even is the "unsecure" option? ... I set up one environment with unsecure and now it's secure, fortunately I had requested for both ports to be opened in firewalls :smile:

been like this since implementation (i didnt put it in :slightly_smiling_face: ) i presume because MEP isnt using public ips and going across INET they chose to use unsecure at the time

something weird has happened i have updated to latest firmware  and as expected securerpc has been enabled on all NSIP/GSLB site ips when performing show rpcnode but mep traffic is being sent out 3011 (non secure port) confirmed with a packet capture. I think its because the default rpc node password is being used (i get the warning when connecting to cli)

weird how yesterday prior to firmware update when i ticked use securerpc it was being sent out 3009