Secure NF communication

The lab default is cleartext on a private network; here is how to harden it with NRF OAuth2, TLS/mTLS, and DPF rate limiting.

Out of the box the service-based interface (SBI) between network functions runs as h2c — HTTP/2 over cleartext. That is intentional for a lab on a private network: it keeps setup trivial and traffic easy to inspect. When you want to harden NF-to-NF communication, the controls below let you require tokens, encrypt the SBI, and rate limit callers.

Hardening is centered on the NRF today

OAuth2 and SBI TLS enforcement live on the NRF. There is no fleet-wide cleartext kill switch across every NF — treat these as defense for the NRF and the private network around the core, not as full end-to-end mutual TLS between all functions.

NRF OAuth2 tokens

Turn on -oauth2 to require a Bearer token on the NRF's protected endpoints. Pair it with -jwt-key, an RSA private key the NRF uses to sign the access tokens it issues. The token endpoint, bootstrapping, health, and metrics stay unprotected so NFs can fetch a token in the first place.

Bash

With -oauth2 set, a request to a protected endpoint without a valid Authorization: Bearer … header is rejected.

TLS and mTLS on the NRF

Give the NRF a certificate and key to switch its listener from cleartext h2c to HTTPS. -tls-cert and -tls-key must be set together:

Bash

For mutual TLS, point -tls-client-ca at a CA bundle that verifies client certs and choose a policy with -tls-client-auth (none, request, or require). mTLS requires server TLS, so keep the -tls-cert/-tls-key pair as well:

Bash

Warning

-tls-client-auth request asks for a client cert but still accepts clients without one; use require to actually enforce mTLS.

DPF rate limiting

The DPF applies a per-IP rate limit to protect its endpoints from a runaway or hostile caller. Tune it with -rate-rps (requests per second, default 1000) and -rate-burst (burst allowance, default 2000), or turn the middleware off entirely with -rate-disable.

Bash

Putting it together

On a trusted, isolated lab network, the h2c default is fine and easiest to debug.
To harden the NRF, enable -oauth2 with -jwt-key and add TLS (or mTLS) on its listener.
Keep the DPF rate limiter on in any shared or exposed environment.

Where to go next

See how NFs find each other in NF discovery, or review every flag in the d3x-core-nrf CLI reference.