Hot Rod client can configure security for clients to connect to. And cross site (xsite) replication uses Hot Rod connection internally but it lacks security related implementation now. So currently xsite replication is impossible if security is enabled.