anchor.diff:  When authentication cannot be completed between two hosts, you will not be able
   to ping between them, because all IP traffic will be rejected. If the `clear`
   policy is not configured correctly, you will also not be able to SSH to the host
  -from another host in the cluster. 
  +from another host in the cluster.
   
   You can use the `ipsec status` command to check that the `clear` and `private`
   policies have been loaded.
  
positive.code: 
  This topic shows how to secure communication of an entire IP subnet from which
  the {product-title} hosts receive their IP addresses, including all cluster
  management and pod data traffic. 
  
  [NOTE]
  ====
  
negative.code: group functionality] is required, then *libreswan* version 3.19 or later is
  required.
  
  xref:../install_config/configuring_sdn.adoc#install-config-configuring-sdn[Configure the SDN]
  MTU to allow space for the IPSec header. In the configuration described here
  IPSec requires 62 bytes. If the cluster is operating on an ethernet network with
  an MTU of 1500 then the SDN MTU should be 1388, to allow for the overhead of
  IPSec and the SDN encapsulation.
  
  [[admin-guide-ipsec-certificates]]
  === Step 2: Certificates
  