anchor.diff:  group functionality] is required, then *libreswan* version 3.19 or later is
   required.
   
  -link:../install_config/configuring_sdn.html[Configure the SDN] MTU to allow
  -space for the IPSec header. In the configuration described here IPSec requires
  -62 bytes. If the cluster is operating on an ethernet network with an MTU of
  -1500 then the SDN MTU should be 1388, to allow for the overhead of IPSec and
  -the SDN encapsulation.
  +xref:../install_config/configuring_sdn.adoc#install-config-configuring-sdn[Configure the SDN]
  +MTU to allow space for the IPSec header. In the configuration described here
  +IPSec requires 62 bytes. If the cluster is operating on an ethernet network with
  +an MTU of 1500 then the SDN MTU should be 1388, to allow for the overhead of
  +IPSec and the SDN encapsulation.
   
   [[admin-guide-ipsec-certificates]]
   === Step 2: Certificates
  
positive.code: 
  This topic shows how to secure communication of an entire IP subnet from which
  the {product-title} hosts receive their IP addresses, including all cluster
  management and pod data traffic. 
  
  [NOTE]
  ====
  
negative.code: When authentication cannot be completed between two hosts, you will not be able
  to ping between them, because all IP traffic will be rejected. If the `clear`
  policy is not configured correctly, you will also not be able to SSH to the host
  from another host in the cluster.
  
  You can use the `ipsec status` command to check that the `clear` and `private`
  policies have been loaded.
  