## 8.5.1  Secure Configuration of the Network Connection
By default, the primary and secondary systems establish communication using the internal host names.
With an IPaddress-virtualHostname mapping on the involved systems, the system replication host name resolution can be set configuring a separate network for system replication data traffic between the primary and the secondary system.
This is done in the [system\_replication\_hostname\_resolution] section in global.ini, where all hosts of the primary and the secondary systems must be defined on each site:
```
global.ini/[system_replication_hostname_resolution] <ip-address_same_site>=<internal_host_same_site> <ip-address_other_site>=<internal_host_other_site>
```
This is also valid for a multitier system replication consisting of three sites (primary, tier 2 secondary, tier 3 secondary or more) because the roles can switch after takeovers and failbacks.
##  Note
The parameters in the global.ini file must be set prior to registering the secondary system, because the hdbnsutil -sr\_register command uses this mapping. Registration is one step in the process of configuring the secondary system.
The entries in the [system\_replication\_hostname\_resolution] section are used in combination with the listeninterface parameter in the [system\_replication\_communication] section. The following combinations are possible:
| [system_replication_com­ munication] listeninterface   | [system_replication_host­ name_resolution]   | Additional Information                                                                                                                                                              |
|-------------------------------------------------------|---------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| .global                                               | No mappings specified                       | Default, if nothing is specified. The default network route is used for system replication communication.                                                                           |
|                                                       |                                             |  Note If you use a public network instead of a separate network, you must secure this connection with additional measures such as a firewall or a virtual private network and SSL. |
| [system_replication_com­ munication] listeninterface   | [system_replication_host­ name_resolution]                                        | Additional Information                                                                                                                                                                                       |
|-------------------------------------------------------|----------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| .global                                               | Entries for the primary and secon­ dary hosts (for all hosts in multitier setups) | A separate network is used for system replication communication.  Recommendation In this way you can use a separate network for multitier system replication.                                               |
| .internal                                             | Entries for the primary and secon­ dary hosts                                     | A separate network is used for system replication communication. The primary hosts listen on the dedi­ cated ports of the separate network only and incom­ ing requests on the public interfaces are rejected. |
|                                                       |                                                                                  |  Note In SAP HANA1.0 SPS 11, network communication for system replication with listeninterface=.internal is sup­ ported for tier 2 replication, but not for tier 3 set­ ups.                                  |
There are two ways to activate [system\_replication\_hostname\_resolution] in your system:
- Restart all sites after setting the parameter
- Temporarily resolve the system replication configuration (no restart of the primary is necessary):
1. Stop secondary.
2. Unregister secondary.
3. Disable primary.
4. Enable primary.
5. Register secondary.
6. Start secondary.
##  Example
Here is an example of the settings for a tier 2 system replication (3 node system) using a separate internal network per site and a separate connection for the system replication:
<!-- image -->
If for some reason, no separate network channel was configured for the SAP HANA system replication communication between the involved systems, the allowed\_sender parameter could be used to restrict communication between primary and secondary to certain hosts. For this, the following settings can be configured in the global.ini file on the primary system:
```
global.ini/[system_replication_communication] Parameter: allowed_sender Value: <list of IP-addresses of secondary or CIDR-netmasks> Example: 10.0.1.0/30
```
The default is "no restriction".
## Related Information
Host Name Resolution for System Replication
Security Aspects for SAP HANA System Replication [page 251]