+

Search Tips   |   Advanced Search

Configure communication with a core group that resides on a DMZ Secure Proxy Server for IBM WAS

This task describes the steps that we must perform to establish communication between a cell inside of a firewall, and a DMZ Secure Proxy Server for IBM WebSphere Application Server outside of the firewall.

Whenever a change is made in core group bridge configuration, including the addition of a new bridge, or the removal of an existing bridge, we must fully shutdown, and then restart all core group bridges in the affected access point groups.

There must be at least one running core group bridge in each core group. If we configure two bridges in each core group, a single server failure does not disrupt the bridge functionality. Also, configuring two bridges enables us to periodically cycle out one of the bridges. If all the core group bridges in a core group are shutdown, the core group state from all foreign core groups is lost.

It is also recommended that:

bprac

Create a tunnel access point group containing the core group access point for the DMZ Secure Proxy Server for IBM WAS, and a tunnel peer access point that represents the cell located inside the firewall...

  1. Create a new tunnel template that will represent the core group bridge tunnel settings that can be exported to the DMZ Secure Proxy Server for IBM WAS. From the administrative console, click...

      Servers > Core Groups > Core group bridge settings > Tunnel templates > New

  2. Select the core group access points to include in this group.

    When specifying the core group access points for the tunnel access point group, use the arrows to place the core group access points in the correct order. The specified order determines the order in which the DMZ Secure Proxy Server for IBM WAS defines the peer core groups of a tunnel peer access point. During startup, the proxy server attempts to connect to the peer core groups according to the order in which they are listed.

  3. Click OK.

  4. Click Tunnel templates, select the name of the template that we just created> Export.

    The file is exported to the WAS_DMGR_PROFILE_ROOT/TUNNEL_TEMPLATE_NAME.props file.

  5. On the DMZ Secure Proxy Server for IBM WAS, import the tunnel template settings into the DMZ Secure Proxy Server for IBM WAS configuration file.

    To import the tunnel template, issue one of the following commands:

      $AdminTask importTunnelTemplate -interactive

    or

      $AdminTask importTunnelTemplate {-inputFileName tunnel_template_name -bridgeInterfaceNodeName DMZ_PROXY_NODE_NAME -bridgeInterfaceServerName secure_proxy_name}

    and then issue the $AdminConfig save command.

    Where tunnel_template_name is the name that you gave the tunnel template that we just created, and secure_proxy_name is the name of our DMZ Secure Proxy Server for IBM WAS.

  6. Optional: Configure the high availability manager protocol to establish transparent bridge failover support.

    During core group bridge state rebuilds, cross-core group state can be moved between running bridges. This situation might cause the data to be temporarily unavailable until the bridge has completed the rebuild process.

    If we are running on Version 7.0.0.1 or later, set the IBM_CS_HAM_PROTOCOL_VERSION core group custom property to 6.0.2.31 for all of our core groups to avoid a possible high availability state outage during core group bridge failover. When this custom property is set to 6.0.2.31, the remaining bridges recover the high availability state of the failed bridge without the data being unavailable in the local core group.

    Complete the following actions to set the IBM_CS_HAM_PROTOCOL_VERSION core group custom property to 6.0.2.31 for all of our core groups.

    1. Shut down all core group bridges in all of our core groups.

    2. Repeat the following actions for each core group in each of our cells:

      1. In the administrative console, click...

          Servers > Core Groups > Core group settings > core_group_name > Custom properties

      2. Specify IBM_CS_HAM_PROTOCOL_VERSION in the Name field, and 6.0.2.31 in the Value field.

      3. Save changes.

    3. Synchronize our changes across the topology.

    4. Restart all of the bridges in the topology.

    All of the core groups within this topology are using the 6.0.2.31 high availability manager protocol.

A tunnel access point group is created containing the core group access point for the DMZ Secure Proxy Server for IBM WAS, and a tunnel peer access point that represents the cell located inside the firewall.


Subtopics


Related:

  • Core group communications using the core group bridge service
  • Configure the core group bridge service
  • Configure the core group bridge between core groups in different cells
  • Configure communication between core groups in the same cell
  • Configure core group communication using a proxy peer access point
  • Configure a DMZ Secure Proxy Server by WAS
  • Tunnel access point group collection
  • Tunnel access point group settings
  • Tunnel peer access point collection
  • Tunnel peer access point settings
  • Tunnel peer access point selection
  • Tunnel templates settings
  • Tunnel templates collection
  • Peer core group collection
  • Peer core group settings