You can set security parameters when you create a route with create route.
create route to dest_replication_server { ... [set username to 'user' ] [set password to 'passwd' ] [set security_mechanism to 'mechanism_name' | set security_parameter to { 'required' | 'not_required' } ]
The parameters are stored in the rs_config table in the RSSD. You must have sa permission to execute them.
Security parameters set at both ends of a route must be compatible.