Table of Contents. About the Author Wendy Wong, Senior Software Architect CA Network and Systems Management R&D Lab. Print Edition: WW210510

Transcription

1

2 Table of Contents Mainframe Network Management 1 SECTION 1: SECURITY 2 NetMaster and Mainframe IP Network Security 2 IPSec Monitoring and Management 2 Secured Connection Management 3 SECTION 2: APPLICATIONS 3 NetMaster and Application Performance Management 3 NetMaster and DB2 3 NetMaster and SoA 4 SECTION 3: PLANNING 5 NetMaster and Business Planning 5 IP Growth Tracker 5 IP Traffic Breakdowns 5 SECTION 4: NETWORK 6 NetMaster and IP Network Management 6 Communications Server V1.11 Compliance 6 Real-Time IP Event Detectors 6 Improved Resource Usage 6 WebCenter Enhancements 6 About the Author Wendy Wong, Senior Software Architect CA Network and Systems Management R&D Lab Print Edition: WW Copyright 2010 CA. All rights reserved. IBM, z/os, z/vm, Linux for System Z, IMS, DB2, WebSphere Application Server, WebSphere MQ and CICS are trademarks of International Business Machines Corporation in the United States, other countries, or both. All trademarks, trade names, service marks and logos referenced herein belong to their respective companies. This document is for your informational purposes only. CA assumes no responsibility for the accuracy or completeness of the information. To the extent permitted by applicable law, CA provides this document "as is" without warranty of any kind, including, without limitation, any implied warranties of merchantability, fitness for a particular purpose, or noninfringement. In no event will CA be liable for any loss or damage, direct or indirect, from the use of this document, including, without limitation, lost profits, business interruption, goodwill or lost data, even if CA is expressly advised in advance of the possibility of such damages.

3 Page 1 Mainframe Network Management Network Management Products Modern businesses are extensively networked. Network management provides the high levels of network visibility and control that are essential today to protect application availability. Network management products do three key tasks: They warn you when application and network performance standards aren't met and when network components might fail. They help you to find and investigate network-related problems. They explain how your network is being used. They show network users, their locations, their applications, their usage patterns, and how much traffic they generate. CA NetMaster Network Management for TCP/IP CA NetMaster Network Management for TCP/IP r12.0 (NetMaster for TCP/IP) provides robust and comprehensive IP network monitoring and diagnostic functions for the z/os mainframe environment. The product helps you perform these tasks: Prevent and anticipate issues with performance violation or event alerts Diagnose problems with tools including SmartTrace, which provides lowoverhead real-time IP packet stream viewing and deep packet inspection Plan and analyze network capacity with real-time, recent, and long-term performance data Manage the networks of many mainframe LPARs from one single, central consolidated place Focus of r12.0 Changes NetMaster for TCP/IP r12.0 adds significant new functionality and capabilities. Focus on network management users: new IP network security functions Focus on application users: new traffic tracing and analysis (simple enough for non-experts!) Focus on current users: r12.0 incorporates many enhancement requests from our valued customer base

4 Page 2 SECTION 1: SECURITY NetMaster and Mainframe IP Network Security The IBM z/os mainframe is renowned as a secure platform. Network security plays a major part in maintaining this reputation. Combined with new legal compliance and audit regulations, this puts considerable pressure on data centers to master the complex areas of z/os IP security implementation and testing. New in r12.0, NetMaster for TCP/IP adds functions that monitor and manage z/os IPSec (VPN) environments, and provide visibility of secured (SSL/TLS) TCP connections. IPSec securely connects private IP hosts over an insecure public network, which may be the Internet. It does this by encrypting the data and using VPN tunnels. IPSec can provide blanket protection for any IP application, without the application being aware. SSL/TLS are secure and encrypted TCP connections. The best known is HTTPS, which secures web pages. Unless AT-TLS (application transparent TLS) is in use, the individual TCP/IP applications themselves need to be specifically coded to use SSL/TLS. IPSec Monitoring and Management z/os IPSec capabilities are provided by IBM Communications Server for z/os. NetMaster functions monitor and manage the IBM Communications Server IPSec environment. IP FILTER AND TUNNEL LISTS IP packet filtering blocks out all IP traffic that an LPAR does not allow. r12.0 adds an IP Filter List and an IP Traffic test to match filters to traffic. IPSec supports dynamic and manual VPN tunnels. Dynamic tunnels are more secure and more widespread. Internet Key Exchange (IKE) tunnels are used for tunnel authentication and negotiation. r12.0 adds lists where you can activate, inactivate, and examine all tunnel types. A summary of the overall IPSec environment is also provided. IPSEC PERFORMANCE MONITORING New IPSec performance monitoring attributes have been added and alerts can be raised when sampling detects a performance violation. Violations can be based on absolute thresholds, or relative baselines. New attributes include - counts of active or expired tunnels, failing tunnels, byte throughput for tunnels, and packets denied or matched by filters. IPSEC TRACING SmartTrace packet tracing decodes IPSec protocol (AH and ESP) packet headers, and identifies and formats IKE negotiation failures. NetMaster IPSec management provides considerable productivity gains compared to performing the same functions using only native Communications Server facilities. These gains reduce both the MTTR and the resolution cost of z/os IPSec problems. NetMaster IPSec management provides considerable productivity gains when implementing, verifying, or updating z/os IPSec environments. Proactive notification of IPSec performance violations reduces MTTR and can help to prevent security problems altogether. NetMaster IPSec functions can be used to test a variety of PCI/DSS compliance requirements, as well as general best practice network security testing.

5 Page 3 Secured Connection Management SECURED CONNECTION LISTS r12.0 adds a variety of secured connection lists, such as all SSL/TLS connections (including AT-TLS), only AT-TLS connections, secure FTP connections, and secure Telnet connections. SECURED CONNECTION EVENT HISTORY r12.0 adds a variety of secured connection event history lists, and security-related IP history search criteria. CONNECTION SECURITY FAILURE EVENTS Two new real-time security-related event detectors can notify users immediately when any of the following conditions occur: 1. An SSL Handshake attempt fails (SSL Handshake failures are also recognized and decoded, if they are traced) 2. A TCP connection ends, indicating that it was disallowed by IDS (intrusion detection services) Users can be notified in real time of SSL failures and their endpoints. Functions are helpful when testing a variety of PCI/DSS compliance requirements, and for general network security testing. Functions are helpful when implementing secured TCP applications. Users can verify that the mix of secured connections compared to unsecured connections is as expected, and see which applications or users have the most secured connections. SECTION 2: APPLICATIONS NetMaster and Application Performance Management Modern network management is about more than just dropped packets and overloaded routers. More powerful and reliable mainframe network hardware and bandwidth has led to demands for network management products that operate at a higher application aware level. Such products provide value and relevance to application support roles, in addition to their traditional network support user base. New in r12.0, NetMaster for TCP/IP adds network-centric tools targeted specifically to DB2 for z/os DBAs and systems programmers, and to z/os web and SoA application developers. NetMaster and DB2 Increasing numbers of web and ebusiness applications are depending on DB2 for z/os. SNA networks are being replaced by cheaper IP hardware. Connectivity products like DB2 Connect and JDBC drivers are becoming more capable and flexible. This all means that more and more DB2 for z/os work is coming in over IP networks. But traditional DB2 for z/os management tools don t include network information. This leaves DB2 support groups with a knowledge blind spot about their DB2 environment and activity. On z/os, DB2 TCP/IP communication uses a DB2 address space called DDF (Distributed Data Facility). DDF uses an application protocol called DRDA (Distributed Relational Database Architecture). NetMaster uses its TCP server monitoring capabilities to watch all DDF tasks and provide visibility to DDF TCP/IP activity.

6 Page 4 DB2 FOR Z/OS NETWORK INFORMATION CENTER The DB2 for z/os Network Information Center is a one stop shop to give DB2 DBAs and systems programmers easy access to TCP/IP functions like connection lists and connection tracing with no network expertise required! DB2 CONNECTIONS To see what DDF tasks are running and the IP addresses currently connected to each, display DB2 TCP/IP connections and listeners. Connection details include RTT, idle time, fragmentation and retransmission counts, and byte throughput cumulatively and in the last 5 minutes. Who are DB2 s current top talkers? Use these functions for comparison and examination of all DB2 for z/os connections including connections with end users, with DB2 Connect, with other DB2 subsystems, and with Java and other applications and products. DB2 TRAFFIC To see which DB2 subsystem is generating most of the DB2 IP traffic, display DDF traffic throughput and application activity. DDF task details include current and total connections, byte throughput cumulatively and in the last hour and the last 5 minutes, and counts from short and long connection duration times. Use these functions to identify the busiest subsystem now and overall, to see which subsystems have very short or very long connections, and to compare overall DB2 IP traffic with traffic from CICS, IMS and MQ. DB2 TRACING For intensive diagnosis, NetMaster SmartTrace has real-time DDF IP packet stream viewing and DRDA deep packet inspection. DRDA packets may be decoded to show either DDM commands or SQL statements. Use SmartTrace to investigate DB2 connection problems, to analyze DB2 application behavior, and to view the SQL text and SQL communications area carried by the TCP/IP packets. NetMaster s proactive warnings of atypical DDF IP activity can enable early investigation and problem prevention, while DB2 IP traffic history is valuable for capacity planning. Providing timely and targeted TCP/IP diagnostic information to DB2 problems speeds up issue resolution and reduces finger pointing between groups. NetMaster and SoA No matter how or with what they are implemented, all web services calls to and from z/os travel as TCP/IP HTTP SOAP requests and responses. NetMaster uses its SmartTrace capabilities to provide real-time packet stream viewing and deep packet inspection of any HTTP server, client, or individual connection. SMARTTRACE HTTP AND SOAP PROCESSING The SmartTrace Multiple TCP Connection Trace captures each separate web services request and response as a logically separate trace, for far easier trace viewing. SmartTrace packet viewing decodes HTTP and SOAP headers. SmartTrace report generation performs and reports on TCP packet reassembly. SOA and web services application developers can diagnose connection problems, compare request/response time stamps, and view SOAP packet payloads.

7 Page 5 SECTION 3: PLANNING NetMaster and Business Planning Even when there are no network problems, the work of today s network manager is not over. What does most of the IP traffic? How fast is IP usage growing? What s causing the network load right now? Network traffic figures are essential for capacity planning, load balancing, and resource justification. New in r12.0, NetMaster adds new displays and enhanced breakdowns of IP traffic figures. IP Growth Tracker Customers have demanded easy to access IP growth figures that are simple to understand, and foolproof enough to just work out of the box without any setup. IP GROWTH TRACKER WEB REPORT The IP Growth Tracker records the growth in total mainframe IP usage over time. IP traffic volumes, connection counts and connection durations are summed at the end of each day, and the daily totals are stored indefinitely. These figures are graphed on a web page, for time frames from Last 14 Days to All Months. Traffic volume is also shown by protocol (TCP, UDP, UDP/EE, and other) and by well-known TCP server name (DB2, CICS and so on). Connection duration counts the number of very short compared to very long connections are also shown. The IP Growth Tracker URL is public, and can be linked to from a customer intranet and added to browser favorites lists, making it available to the whole organization. Data is stored for long periods. Raw data values can be downloaded to a CSV file and input to any application. Connection durations may highlight unexpected usage patterns overall or on a particular day, for example, many very short or abnormally long connections. IP Traffic Breakdowns The NetMaster Packet Analyzer sees all IP traffic flow in and out of all monitored z/os IP stacks, and collects figures as it watches. INTERFACE-TO-APPLICATION TRAFFIC CORRELATION Top IP business applications that sent traffic over a specific network interface Top network interfaces that specific IP business application traffic flowed over TRAFFIC TOP TALKERS Top 10 remote addresses per remote network, and byte totals for all remote addresses Individual TCP/IP connection traffic for last 5 minutes / hour / cumulative TCP/IP application traffic for last 5 minutes / hour / cumulative If an interface must be taken down, identify which applications would be affected. See if any intended application load balancing over interfaces is actually working. Identify the current heaviest users among connections and remote addresses. Compare remote address list with router access rules, for security checking.

8 Page 6 SECTION 4: NETWORK NetMaster and IP Network Management New in r12.0, NetMaster for TCP/IP delivers many enhancements to the core IP network management functions. Communications Server V1.11 Compliance NetMaster for TCP/IP r12.0 is compliant with IBM Communications Server Version 1.11 updates, including OSA3 support. Real-Time IP Event Detectors IP event detectors have been augmented by new real-time detectors based on packet or system event streams. Continuous examination of real-time IP packet streams is the only way to reliably catch all the Needle in a Haystack events that can warn you of possible application, performance, or usage issues. You can tailor detectors for the exact real time network events your department needs to know about. You are notified immediately when any of these events happen. A restricted, critical, or noteworthy TCP connection has started. Active TCP connection count to a server has become very high or very low. A mainframe application has abnormally terminated an active connection. An unusually large number of TCP connection attempts have failed. Secured TCP connection setup (SSL handshake negotiation) has failed. Event detectors can be targeted at individual known TCP connections, applications, or IP hosts. Detectors can also be set up to be less specific and report on more occurrences. Improved Resource Usage Some functions have been redesigned internally to improve storage use and performance. WebCenter Enhancements Additional functions are available on WebCenter, NetMaster s web browser based UI. WebCenter processing is embedded in NetMaster and requires no off-platform or third-party products. WebCenter additions include the following capabilities: SmartTrace packet formatting including packet list CSV generation IP, FTP and Telnet Event History lists, including CSV generation IP Summary Enterprise Extender Traffic and Subsystem Traffic charts These changes help to maintain and increase the usefulness and value of NetMaster for TCP/IP for mainframe IP network support groups. CA NetMaster products provide robust and comprehensive network monitoring and diagnostic functions for the z/os mainframe environment including TCP/IP, IPSec, SNA, EE and x.25 networks. To learn more about CA NetMaster Network Management for TCP/IP, please visit