Every CM peer has its own unique CM Peer Service authentication token (auth-token). The token is required for communication with each peer based on the following secure interactions:
Authentication—Authenticates each CM peer based on public or private keys.
Authorization—Authorizes each peer to access only the CM Peer Service on the local system. All other management access is protected. In addition, each peer's access is limited to specific features that are enabled locally for that peer through the CM Peer Service interface.
Confidentiality—Provides encryption for all CM Peer Service communications.
Integrity—Provides communication integrity.
In order for the CM peers to interact, each peer that wants to participate in the CM Peer Service must import the unique authentication token from the other CM peers.
When a peer’s authentication token is imported, the peer is approved for CM Peer Service (and associated features) with your Central Management System appliance. Importing a token is similar to creating an account. Therefore, the token must be from a trusted source that is authenticated with a secure out-of-band mechanism. For example, if the token is sent in a signed email, the sender of the email can be validated to be the administrator of the originating CM peer.
After the token is generated, it can be reused for the token exchange with all other peers. Trellix recommends that you reuse the same token for each exchange. If you generate a new token, it must be reimported on all the other participating CM peers to resume CM Peer Service functionality.
Important
: If you change the hostname or IP address of any CM peer, you must generate a new token for that CM peer and import it on all the peers of that Central Management System network.
Note
You can generate and import authentication tokens only using the CLI.
Admin access to the Central Management System appliance.
A connection to the Dynamic Threat Intelligence (DTI) Cloud.
Network connectivity over SSH (port 22) and HTTPS (port 443) must be allowed on each of the participating Central Management System appliances.
Each CM peer must have a unique hostname.
CM Peer Service must be enabled on your Central Management System appliance.