anchor.diff:  When authentication cannot be completed between two hosts, you will not be able
   to ping between them, because all IP traffic will be rejected. If the `clear`
   policy is not configured correctly, you will also not be able to SSH to the host
  -from another host in the cluster. 
  +from another host in the cluster.
   
   You can use the `ipsec status` command to check that the `clear` and `private`
   policies have been loaded.
  
positive.code: group functionality] is required, then *libreswan* version 3.19 or later is
  required.
  
  link:../install_config/configuring_sdn.html[Configure the SDN] MTU to allow
  space for the IPSec header. In the configuration described here IPSec requires
  62 bytes. If the cluster is operating on an ethernet network with an MTU of
  1500 then the SDN MTU should be 1388, to allow for the overhead of IPSec and
  the SDN encapsulation.
  
  [[admin-guide-ipsec-certificates]]
  === Step 2: Certificates
  
negative.code: 
  This topic shows how to secure communication of an entire IP subnet from which
  the {product-title} hosts receive their IP addresses, including all cluster
  management and pod data traffic.
  
  [NOTE]
  ====
  