## 10.2 Secure Internal Communication Between Sites in System Replication Scenarios
Communication between sites in a system replication scenario is always authenticated. In addition, it is possible to secure internal network communication between primary and secondary sites using TLS/SSL.
System replication is a mechanism for ensuring the high availability of SAP HANA systems, as well as disaster recovery. Through the continuous replication of data from a primary to a secondary system (or systems), including in-memory loading, system replication facilitates rapid failover in the event of a disaster. Production operations can be resumed with minimal downtime.
Communication between the sites in a system replication landscape must be secured. The system PKI (public key infrastructure) that is automatically created during system installation is the default and recommended mechanism for communication. No interaction is required to set up the system PKI. However, you can also set up and configure your own PKI (see Legacy Configuration of Secure Internal Communication ).
##  Remember
System replication is configured for the system as a whole. This means that the system database and all tenant databases are part of the system replication.
## Configuring Authentication Between Sites
To ensure that only configured systems in a system replication landscape can communicate with each other, SAP HANA uses certificate­based authentication based on the system PKI. To establish trust between systems, you must copy the system PKI SSFS data file and key file from the primary system to the same location on the secondary system(s). These files can be found at the following locations:
- $DIR\_INSTANCE/../SYS/global/security/rsecssfs/data/SSFS\_&lt;SID&gt;.DAT
- $DIR\_INSTANCE/../SYS/global/security/rsecssfs/key/SSFS\_&lt;SID&gt;.KEY
Copy the files before you register the secondary system with the primary system.
## Configuring TLS/SSL-Secured Communication
In addition to authenticated communication, it is also possible to secure the following communication channels between primary and secondary systems using TLS/SSL:
- Metadata channel used to transmit metadata (for example, topology information) between the sites
- Data channel used to transmit data between the sites
For more information on how to enable TLS/SSL on these communication channels, see the SAP HANA Administration Guide .
##  Note
On SAP HANA systems with dynamic tiering, the same configuration applies. No additional steps are required. However, before you configure communication for dynamic tiering, see SAP Note 2356851.
Be aware that you need additional licenses for SAP HANA options and capabilities. For more information, see Important Disclaimer for Features in SAP HANA.
## Additional Network Security
You can further secure communication between sites by configuring SAP HANA to use exclusively a separate network dedicated to system replication for communication between primary and secondary sites.
It is also recommended that you configure the IP addresses of those hosts that are allowed to connect to the ports required for system replication.
For more information, see also the section on network security and the section on host name resolution in the SAP HANA Administration Guide .
## Related Information
Legacy Configuration of Secure Internal Communication [page 257]
Server-Side TLS/SSL Configuration Properties for Internal Communication
Configure Secure Communication (TLS/SSL) Between Primary and Secondary Sites [page 259]
Host Name Resolution for System Replication
Network Security [page 263]
Secure Internal Communication [page 252]
<!-- image -->
SAP Note 2356851