I have updated one of my data node IP and it's un able to join ES cluster any more.
BTW, x-pack plugin was installed.
Master node logs
[2017-01-13T07:08:17,990][ERROR][o.e.x.s.a.AuthenticationService] [es2-master.xxxx.com] caught exception while trying to read authentication from request [transport request action [internal:transport/handshake]]
java.lang.IllegalArgumentException: tampered signed text
at org.elasticsearch.xpack.security.crypto.CryptoService.unsignAndVerify(CryptoService.java:220) ~[x-pack-5.1.1.jar:5.1.1]
at org.elasticsearch.xpack.security.authc.Authentication.deserializeHeaderAndPutInContext(Authentication.java:108) ~[x-pack-5.1.1.jar:5.1.1]
at org.elasticsearch.xpack.security.authc.Authentication.readFromContext(Authentication.java:97) ~[x-pack-5.1.1.jar:5.1.1]
at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.lookForExistingAuthentication(AuthenticationService.java:195) [x-pack-5.1.1.jar:5.1.1]
at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.authenticateAsync(AuthenticationService.java:178) [x-pack-5.1.1.jar:5.1.1]
at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.access$000(AuthenticationService.java:140) [x-pack-5.1.1.jar:5.1.1]