TCP/IP configuration on System i5

Transcription

1 on System i5 Michigan iseries Tech Conf Spring 2006 Larry Bolhuis Arbor Solutions, Inc Grand Rapids, MI 1 Agenda Configuration Line Descriptions (Yes we need them!) Interfaces Routes DNS Resolution IP attributes DHCP Server DNS Server Select Other Servers Mixed throughout: Configuring Redundant Interfaces! MITECH S06 2

2 IP Terms Host ANY device with an address Network Server, Client, Printer, Router, Firewall, Toaster, etc. A group of Hosts with the same network number Typically are on the same physical network i.e. Ethernet, Token-ring, Dialup RAS Server, Cable modem, DSL MITECH S06 3 Internet Protocol Version 4 (IPV4) Address Format IPV4 addresses are 32 bits long (4 bytes) Usual representation is dotted decimal. i.e Each octet ranges from 0 to 255 as it represents 8 binary bits (one byte) Total of just over 4 billion addresses, sounds like a lot, but. The Host and the Network address are combined in the IP address MITECH S06 4

3 Reserved/Special Purpose Host Addresses No matter how large or small the network there are two host addresses you cannot assign. The Network is host address with all bits of 0 In the Class C network x the host Network address is The Broadcast address is host address with all bits of 1 In the same network the Broadcast address is This is why there are only 254 (256-2) address available in a Class C network. The smallest network ( or CIDR /30) has two usable addresses plus the network and broadcast addresses. MITECH S06 5 iseries Access for The Web Home Intended for use by end users not for administration use. Note the left side menu has nothing for dealing with Interfaces, addresses routes etc. Needs no install on the client side. Very powerful and is where iseries Access is heading. MITECH S06 6

4 Baseline All screens and iseries Navigator panels are i5/os V5R3 *Except where noted as V5R4 Managed Systems are i5/os V5R3 *Except (see above!) First we will configure minimal IP via Green Screen followed by the same in inav. Additional servers and options will be covered in inav only Redundant and load balanced interfaces allow your system (and more importantly all those 5250 sessions!) to survive a LAN card, LAN Cable or Switch failure. Since we need a physical interface to connect with inav or Telnet we will briefly look at a physical interface first MITECH S06 7 Redundant, Load Balanced Highly Available Network Connections To achieve this goal, several things are needed. More than one Physical line (i.e. Ethernet), preferably on Separate IOPs and on separate Busses for best protection More than one cable connection, preferably to separate network switches A separate IP address for each Physical line (in addition to a production IP address) These addresses must all be in the same IP Subnet Special routes that direct OS/400 to balance traffic on selected Interfaces A virtual IP interface with the production IP address OS/400 V5R2 or i5/os V5R3 or newer Pieces of this configuration will be noted in this space! MITECH S06 8

5 You should have interfaces already and you should have more than one to your local network. More on how and why that s important later! Fixed Speed and Duplex Help prevent line drops Physical Line Key Pieces: -Resource name -Line Speed -Duplex I strongly recommend setting both line speed and duplex rather than selecting *AUTO on both the iseries AND Network switch. MITECH S06 9 CFGTCP Menu TCP/IP Config Some options have commands behind them Others are available only here We will concentrate on Interfaces, routes, host table and domain info. MITECH S06 10

6 Option 1 from CFGTCP menu Command: (option only) Show all configured IPv4 addresses on the iseries F11 will show status (If TCP/IP is active) Add, Change, Remove, Start, Stop from here Also see NETSTAT *IFC for status and Start/Stop MITECH S06 11 Option 1 (ADD) from work with TCP/IP interfaces Command: ADDTCPIFC Internet Address assigned by your network administrator It must be fixed. iseries will not seek a DHCP address Line name must exist Subnet mask also comes from network admin MITECH S06 12

7 Option 2 from CFGTCP menu Command: (option only) Displays all Static routes (i.e. Manually entered) Can add, change, remove routes from here Also see NETSTAT *RTE for learned and active routes MITECH S06 13 Option 1 (ADD) from work with TCP/IP routes Command: ADDTCPRTE Shown adding the default route, Special value *DFTROUTE Special value for Subnet Mask of *NONE Next hop address is usually a router and MUST be on the local network! MITECH S06 14

8 Option 12 from CFGTCP menu Command: CHGTCPDMN Must enter the server s Host and Domain Names Search Priority designates local host file or DNS queried first DNS Server addresses should also be specified hostname.domain MUST resolve to an IP on this system!! MITECH S06 15 Option 12 from CFGTCP menu (Page 2) Command: CHGTCPDMN Introduced in V5R2 Can now use ports other than the default of 53 Optionally can use TCP protocol, server must support it! Servers can be rotated or default of top to bottom Retry count and intervals can also be adjusted MITECH S06 16

9 Option 11 from CFGTCP menu Command: (option only) Maintenance of Hosts file (QUSRSYS/QATOCHOST mbr HOSTS) Up to four names may be associated with each IP Address Note that you can change names with option 2 but option 7 allows you to change the IP address ( Rename the IP ) MITECH S06 17 iseries Navigator iseries navigator (inav) has much greater flexibility inav can configure much more than the command line Some servers and other stuff are configured via inav only DNS, DHCP, PPP, IASPS, Some parameters are available in inav only, examples: Proxy Arp on Interfaces Interface Affinity (*V5R4) Interface filters Some statistics are available in inav only, examples: Interface Stats Graphical line utilization DNS Server stats, DHCP Lease information MITECH S06 18

10 iseries Navigator Entry point iseries Navigator is the preferred interface for managing iseries TCP/IP and is the only way to accomplish many tasks. In order to get this going you do need to have a line description active and configured with a TCP/IP address. You can establish your initial IP address configuration on the green screen or with the Easy Setup tool included with iseries Access MITECH S06 19 Expand: Network, TCP/IP cfg, IPv4 Click on: Interfaces Lists all IP Interfaces (Addresses) on the system Status and significant attributes. MITECH S06 20

11 Each interface gets an IP address and a subnet mask. Note that in inav a description can be added This interface is a virtual IP interface NOT associated with a specific hardware line description, However in V5R4 they can gain affinity for a specific line. Virtual IP addresses have a mask Usually 1492 for 100Mb, 8991 for Gbe Lines To be visible to the outside the address must be in the address range of a physical interface This is the Virtual Interface used for highly available connections Proxy Arp must be enabled! (V5R2 option) MITECH S06 21 V5R4 Panel for a virtual IP interface. Note the addition of the ALIAS name. Also new in V5R4 is the ability to prefer a specific line (via it s associated physical IP) Useful for example if you have a 1Gb line and a 100Mb line and wish to prefer the Gb line. This is the Virtual Interface used for highly available connections Note that MTU must match smallest of available lines. MITECH S06 22

12 Expand: Network, TCP/IP cfg, IPv4 Click on: Routes Add new from left panel Modify from right Lists all IP Routes on the system, manual and learned Status and significant attributes. MITECH S06 23 Types of Routes Host Routes (Consulted First) Specify a route to a specific Host Network Routes (Consulted Second) Specify a route to a network of Hosts Routes to the local network are added automatically or you may enter your own (example next) Many of these can be added Duplicates ARE allowed Default Route (Consulted Last) Specify routers to be used when no Host or Network routes match MITECH S06 24

13 Showler Route Properties A route to the local network Keys are: - Destination Network (ours) - Subnet Mask - Next hop (interface on this sys) May not change active route [Advanced Tab] Bind to the Next hop address above Route precedence must NOT be 5 Schowler routes are used to load Balance network connections You must create one of these for each interface connected to a network. Route precedence must match for all of them. (*!) MITECH S06 25 Expand: Network, TCP/IP cfg, IPv4 Right Click on: TCP/IP Config. Stop Options Utilities Either STOP option is fatal to your inav connection!! Utilities are run from the iseries. Good for testing connectivity. MITECH S06 26

14 TCP/IP Configuration Properties [Host Domain Information Tab] Update the Host name for this server Update the domain name Enter up to three DNS servers Additional domain suffixes may also be added here. They are searched in order Advanced allows you to modify connectivity options used to communicate with the DNS Servers MITECH S06 27 TCP/IP Configuration Host Table Updates the Host names table: QUSRSYS/QATOCHOST member HOSTS Up to four names per IP may be entered. This panel is used for both add and Edit. MITECH S06 28

15 Additional configuration At this point we have configured each item needed for basic communication The rest of the configuration will be items only or at least more easily configured from inav MITECH S06 29 TCP/IP Configuration Properties [Servers to Start Tab] This is the only place you can see all the TCP/IP Servers and display or change whether they should start when TCP/IP Starts. You can also set this attribute individually from CHGxxxxxA commands or from the individual servers properties in inav Note that SNMP is missing here and in inav in general. Hmmm MITECH S06 30

16 IPv4 Properties [General Tab] General properties for IPv4 Defaults normally apply here! V5R2 Enhancement Network file cache is used with HTTP to support FRCA (Fast Response Cache accelerator) This can dramatically speed web serving in many instances. MITECH S06 31 IPv4 Properties [Transports Tab] MITECH S06 32

17 Expand: Network, TCP/IP cfg, IPv4 Remote address and port Local address and port Connection State and time Since last traffic Traffic Statistics Inbound and outbound Click on: Connections F11 to subset the list. Very powerful selection Shows connections to and from this system *EXCELLENT* for troubleshooting! MITECH S06 33 This is the list of TCP/IP Servers included in i5/os All of them can be maintained from here Expand: Network, Servers Click on: TCP/IP Right click on any for menu. Note upper right corner shows time since refresh MITECH S06 34

18 DHCP- Dynamic Host Configuration Protocol Grew from RARP and then BOOTP All of these run on the wire protocol (ethernet, token-ring, Wireless, etc) Host sends a broadcast packet requesting IP information (Address, Mask, Gateway..) DHCP Server(s) respond with an offer Host acknowledges the best offer RARP Reverse Address Resolution Protocol BOOTP Bootstrap Protocol MITECH S06 35 DHCP - Server Server is configured with information for each subnet it serves Server tracks available addresses and active leases Lease times are set to expire often enough so that DHCP changes are effective but not so short as to increase network traffic MITECH S06 36

19 DHCP server DHCP Flow Router with BOOTP relay DHCP server Hosts submits a DHCP request IP address discover message BOOTP Forwarding routers pass these requests along More than one server may respond Host selects one address and replies to the server Server commits the address and responds MITECH S06 37 DHCP Server configuration Dynamic Host Configuration Protocol This server will hand out the required pieces of information a host needs to communicate on the network IP Address Subnet Mask Domain Name Default Gateway DNS Servers Additionally it is told who is allowed to get what addresses. Generally a range of addresses is used for dynamic configuration and the rest are held for static use (Servers, Routers etc) Lease time is assigned. Low lease times means higher traffic and load as well as the possibility that leases may expire while the DHCP server is down. Long lease times mean low traffic and load but changes in the DHCP server take a long time to replicate to the hosts in the network. MITECH S06 38

20 DHCP Server Configuration All subnets, are listed here Right click Global and select Properties. Shown is [Leases] tab. This sets the default time the address lease is valid for. When this time is 50% used up the client will start attempting to renew the lease. This gives a cushion for renewal MITECH S06 39 DHCP Server Configuration [Dynamic DNS] tab. Updates are sent to the DNS Server when the lease is granted. May update Forward (A) records, Reverse (PTR) records, or both and the domain name. [Options tab] There are 80 options! At the global level normally only the Domain Name and Domain name servers are specified Others are specified at the subnet level MITECH S06 40

21 DHCP Server Configuration Subnet properties [Address Pool] tab. Defines the addresses available to be leased to clients. Can be done by range (as shown) or can be a subnet of a larger network. (i.e /24 of the /16 network) Sets the subnet mask for the range Also addresses can be excluded for those times you find something that you don t want to change unexpectedly. MITECH S06 41 DHCP Server Configuration Subnet properties [Options] tab. In this space the options for the subnet are defined. Options entered here override options entered at the global level. Usually a subnet mask and Router are defined here. MANY options can be specified but this is a basic configuration! MITECH S06 42

22 DNS Domain Name System Do you really want to know the numbers of every server you need to access? (Hint: NO!) We need a way to determine the address of etc. DNS Correlates numbers with names Based on Berkley Internet Names Domain (BIND) Hierarchical name system world wide MITECH S06 43 DNS Content DNS Servers contain: IP Address to host name mapping Time to Live for that mapping Mail server names for your domain Delegations for sub domains When the server doesn t know it checks upstream servers When they don t know they go to the root servers to find out who to ask. MITECH S06 44

23 DNS Server configuration Domain Name System This server translates Fully Qualified Domain Names (FQDN) to IP addresses. i.e. is Mail servers are assigned via MX (mail exchanger) records i.e. arbsol.com has smtp1w.arbsol.com and smtp1s.arbsol.com as MX entries. These are prioritized and they are used from the top. Addresses have limited life spans in outside caches. This is assigned by the DNS server as well. Long lifetimes means lower internet use as addresses live in caches Short lifetimes increases traffic as addresses age out of caches sooner, however changes propagate more quickly DNS servers can work together and update each other in Primary/Secondary relationships. Advanced course: DNS Servers can be updated by DHCP servers as addresses are leased. This is Dynamic DNS (DDNS) MITECH S06 45 DNS Server Configuration Shown are the domains defined in DNS that are either defined here (Primary) or mirrored here (Secondary) To view contents of a domain, click on it. i5/os includes BIND version 8 which requires PASE V4Rx included BIND version 4. Migration is supported. MITECH S06 46

24 DNS Server Configuration Shown are the hosts listed in the frankenseries.com domain. Below are the SOA (Start Of Authority) and DNS records for the domain The New option is used to add hosts to the list Right click on the domain for menu. Select Properties for options. MITECH S06 47 DNS Server Zone properties SOA record Each zone must have an address assigned. Also the timeouts are defined here, setting these wrong can be very bad. DO NOT USE the values here as these are WAY LOW. (This server is used for testing stuff!) MITECH S06 48

25 Generic server configuration All servers on iseries have SOME properties even if it s just Start at IPL MANY servers have extensive configuration. We can t POSSIBLY even touch them here. Peruse them to see what options are available. We will look at just one for ideas and a sample: That the Database server. This guy supports ODBC/JDBC and is often an issue for iseries shops. MITECH S06 49 iseries Access Servers These are also TCP/IP but are iseries defined. Each has properties like the TCP/IP servers Right click for menu We ll look at properties next. MITECH S06 50

26 Database Server Properties Most important configuration option here is to box certain users into other subsystems, thus increasing or decreasing resources for those users. Once you have defined at least one the system adds <public> as the default. Watch the Alternate Action!! You may route individual or a range of IPs and you may only do this by IP. YOU must still create the required subsystem and populate pre-start and routing entries to support these users. (Hint: Clone QUSRWRK!) MITECH S06 51 Summary i5/os TCP/IP Support is full and rich. All pieces are included in i5/os $free Understanding your configuration and the system s capabilities will help assure that you get the most from your system Larry Bolhuis lbolhuis@arbsol.com MITECH S06 52

27 Summary Communications between hosts requires the ability to distinguish one from another and the IP Address does that. Hosts are grouped by network, typically a geographic or physical connection (i.e. Ethernet) The subnet mask defines how many of the 32 bits constitute the network portion of the address, the rest are the host portion Routes are used (Coming up next) to communicate outside the local network Addresses must be unique for every host Assigning them is best left to DHCP Names are used whenever possible to mask the numbers Mistakes will haunt you! Do your best. Larry Bolhuis lbolhuis@arbsol.com MITECH S06 53