New GoAnywhere File Transfer Set Up Tasks

Transcription

1 New GoAnywhere File Transfer Set Up Tasks 1 Task Name Comments Assigned To Duration NEW GO ANYWHERE FILE TRANSFER SETUP TASKS 2 STANDARDS 3 4 PCSSC will be encrypting all files whether they contain PII (personally identifiable information) or not, using PGP - that means you will need to obtain both prod and non-prod PGP keys. PCSSC will provide one directory on the MFT server for each campus or vendor and application to send files to that will use the same credential scheme as above. Prod and non-prod, etc. The Sftp server will have folders where locations/vendors place their files. 5 RECOMMENDATIONS 6 7 PCSSC will set up the FTP on a Production Server and the connections can be adjusted to point to any environment for testing purposes per the needs of the business. PCSSC recommends all files be placed into one directory (whatever the root context is for the credential used) at the recipients FTP server. We recommend that campus have a utility to move the files off the FTP server into internal directories for the applications that consume the data files. This is a good practice from a security point of view. 8 PLANNING (Initial Scope and Design) Open a Service Request with PCSSC to request GoAnywhere Job(s) be configured Complete the GoA MFT Form and attach it to the Service Request ticket. Complete Control-M Job Form for each new Job Provide Job Documentation and Runbook for each new job 13 Provide Contact information for each Infrastructure Team at the sending and receiving locations Estimated time to complete a new File Transfer Configuration is two weeks minimum per environment to three months maximum end to end, depending on what needs to be configured. Setup of new File transfers on existing infrastructure is based on existing SLAs. Ex:. GoA MFT Form attached.. Control-M Form attached.. Sample Runbook Documentation attached. Requesting IT Business Partner Requesting IT Business Partner 1 Requesting IT Business Partner 10 Requesting IT Business Partner 10 Requesting IT Business Partner 14 Unix System Administrator Requesting IT Business Partner 1 15 Windows System Administrator Requesting IT Business Partner 1 16 Network Administrator Requesting IT Business Partner 1 17 Change Control Group Requesting IT Business Partner 18 Any External Vendor or Customer Contact Name and Phone Requesting IT Business Partner Data Gathering Provide Procedure for opening a Service Request to each of the Infrastructure teams above. Requesting IT Business Partner 1 21 A PCSSC Coordinator will assign the Service Request to a Liaison PCSSC Coordinator 1 Page 1 of 9

2 22 23 Task Name Comments Assigned To Duration 24 DEVELOPMENT Liaison will contact the Requesting IT Business Partner and review the Service Request scope and design Liaison will set up Weekly ½ Hour File Transfer Status Meeting with the Requesting IT Business Partner 25 GoA CONFIGURATION TASKS UNIX Configure Transfer Source/Destination Servers to Communicate with GoAnywhere via SFTP/FTPS 30 Windows UNIX 35 Open a Work Request to Transfer Source/Destination Unix System Administrator, if needed Server Configuration Completed Open a Work Request to Transfer Source/Destination Windows System Administrator, if needed Server Configuration Completed Set up a Standard User ID that will be used to log into GoA and Transfer Files Open a Work Request to the IT Business Partner Unix System Administrator, if applicable, to set up a Standard Userid that will be used to log into GoA and transfer files PCSSC Liaison Unix System Administrator 10 Windows System Administrator 10 PCSSC Liaison 36 User ID Configured Unix System Administrator 1 37 Windows Open a Work Request to IT Business Partner Windows System Administrator to set up a Standard Userid that will be used to log into GoA and transfer files User ID Configured 40 Establish Userid RW Access to Transfer Source/Destination file Directories 41 Unix 42 Open a Work Request to IT Business Partner Unix System Administrator to give IT Business Partner Enterprise User ID RW access to the Transfer to/from File Directories Windows System Administrator 1 PCSSC Liaison Only if applicable 43 Establish UserID RW Access Unix System Administrator 1 44 Windows 45 Open a Work Request to IT Business Partner Windows System Administrator to give IT Business Partner Enterprise User ID RW access to the Transfer to/from File Directories Only if applicable Page 2 of 9

3 Task Name Comments Assigned To Duration 46 Establish UserID RW Access Windows System Administrator 1 47 Open Firewalls PCSSC Liaison 48 If there is a Firewall in place at the location, open a Work Request to the IT Business Partner Network Administrator to Enable Firewall Access to the GoA Server PCSSC Tool Admin 1 49 Open Firewall Network Administrator Generate Public and Private Keys and share with the Destination Party 51 Modify RACF Permissions (for Mainframe Files) If necessary 52 Open a UCOP Mainframe Service-Now RACF request. GoA Tool Admin File Owner 1 53 Complete RACF Changes UCOP Mainframe RACF Admin 1 54 Configure GoA Services Configure an Application-Specific Services Userid and Password Configure Services Trigger 57 Configure GoA Director Configure GoA Director Resources Configure Director Projects (The Jobs that are going to run) 60 CONTROL-M CONFIGURATION TASKS TESTING Configure Control-M Jobs Liaison configures GoA Director resources based on templates. Liaison configures GoA Director projects based on templates. PCSSC Liaison 5 PCSSC Liaison Test each new File Transfer PCSSC Liaison and Business Partner IT Business Partner Sign Off Test File Transfers Successful Requesting IT Business Partner 0 65 DEPLOYMENT 66 Load all relevant documentation to PCSSC Sites and update FTP list PCSSC Liaison 67 Pre GO LIVE communication plan PCSSC Liaison and Business Partner 2 68 Review Communication Plan with department POC PCSSC Liaison and Business Partner 1 69 Review Support Model with Requesting IT Business partner 70 Promote File Transfer to PROD 71 Test File Transfer in PROD PCSSC Liaison and Business Partner IT Business Partner Sign Off - File Transfers Successful in PROD Requesting IT Business Partner 0 73 Communicate Changes Requesting IT Business Partner 74 Set up in XMatters or Pager Duty PCSSC Liaison and Business Partner 1 75 GO LIVE Page 3 of 9

4 Discussions on New GoAnywhere File Transfer Set Up Tasks NEW GO ANYWHERE FILE TRANSFER SETUP TASKS Row 1 Started by Beatrice Cardona on 03/23/15 10:26 AM Beatrice Cardona on 03/23/15 10:26 AM Open a Service Request with PCSSC to request a GoAnywhere Job be configured Row 9 Started by Beatrice Cardona on 03/17/15 11:47 AM Send an to uc-pcssc-tickets@berkeley.edu Beatrice Cardona on 03/17/15 11:47 AM Complete the MFT Form and attach it to the Service Request ticket. Row 10 Started by Beatrice Cardona on 03/17/15 11:47 AM The data gathering process involves obtaining the following information (please see the form for details). Process Name Run Frequency Dependency Run Control Values Output destination DDODS related information Informatica related information Beatrice Cardona on 03/17/15 11:47 AM Configure Server to Communicate with GoAnywhere via SFTP/FTPS Row 26 Started by Beatrice Cardona on 03/10/15 3:45 PM NOTE: For UCB, the below Enterprise IDs are already set up. If you use a new host, your Unix System Administrator will need to configure these (PROD) app_goamftprod (ssh keys are utilized) (QA) app_goamftqa (ssh keys are utilized) (DEV) app_goamftdev (ssh keys are utilized) Note: For UCOP, the below Enterprise IDs are already set up. If you use a new host, your Unix System Administrator will need to configure these (PROD, QA, DEV) svcappmft (ssh keys are utilized) Note: For UCSF, the below Enterprise IDs are already set up. If you use a new host, your Unix System Administrator will need to configure these (PROD) none (QA) none (DEV) none Note: For UCPath, the below IDs are already set up. If you use a new host, your Unix System Administrator will need to configure these accounts for Page 4 of 9

5 your new host (PROD) none (QA) none (DEV) none Beatrice Cardona on 03/10/15 3:45 PM Open a Work Request to your Unix System Administrator, if needed Row 28 Started by Beatrice Cardona on 03/17/15 11:36 AM Note: UCB uses SFTP Beatrice Cardona on 03/17/15 11:36 AM Server Configuration Completed Row 29 Started by Beatrice Cardona on 03/17/15 11:35 AM Lead Times Vary Beatrice Cardona on 03/17/15 11:35 AM Open a Work Request to your Window System Administrator, if needed Row 31 Started by Beatrice Cardona on 03/17/15 11:36 AM Note: UCB uses IIS FTPS Beatrice Cardona on 03/17/15 11:36 AM Server Configuration Completed Row 32 Started by Beatrice Cardona on 03/17/15 11:35 AM Lead Times Vary Beatrice Cardona on 03/17/15 11:35 AM Set up a Standard User ID that will be used to log into GoA and Transfer Files Row 33 Started by Beatrice Cardona on 03/10/15 3:50 PM NOTE: For UCB, the below Enterprise IDs are already set up. If you use a new host, your Windows System Administrator will need to configure these (PROD) campus\svc-ctm-mft-prod (QA) campus\svc-ctm-mft-qa (DEV) campus\svc-ctm-mft-dev NOTE: For UCSF, the below Enterprise IDs are already set up. If you use a new host, your Windows System Administrator will need to configure these NOTE: For UCOP, the below Enterprise IDs are already set up. If you use a new host, your Windows System Administrator will need to configure these Page 5 of 9

6 NOTE: For UCPath, the below Enterprise IDs are already set up. If you use a new host, your Windows System Administrator will need to configure these Beatrice Cardona on 03/10/15 3:50 PM Open a Work Request to your Unix System Administrator, if applicable Row 35 Started by Beatrice Cardona on 03/17/15 11:35 AM "NOTE: For UCB, the below Enterprise IDs are already set up. If you use a new host, your Unix System Administrator will need to configure these (PROD) app_goamftprod (ssh keys are utilized) (QA) app_goamftqa (ssh keys are utilized) (DEV) app_goamftdev (ssh keys are utilized) Note: For UCOP, the below Enterprise IDs are already set up. If you use a new host, your Unix System Administrator will need to configure these (PROD, QA, DEV) svcappmft (ssh keys are utilized) Note: For UCSF, the below Enterprise IDs are already set up. If you use a new host, your Unix System Administrator will need to configure these (PROD) none (QA) none (DEV) none Note: For UCPath, the below IDs are already set up. If you use a new host, your Unix System Administrator will need to configure these accounts for your new host (PROD) none (QA) none (DEV) none" Beatrice Cardona on 03/17/15 11:35 AM Open a Work Request to your Windows System Administrator to set up a Standard Userid that will be us Row 38 Started by Beatrice Cardona on 03/17/15 11:37 AM "NOTE: For UCB, the below Enterprise IDs are already set up. If you use a new host, your Windows System Administrator will need to configure these (PROD) campus\svc-ctm-mft-prod (QA) campus\svc-ctm-mft-qa (DEV) campus\svc-ctm-mft-dev Page 6 of 9

7 NOTE: For UCSF, the below Enterprise IDs are already set up. If you use a new host, your Windows System Administrator will need to configure these NOTE: For UCOP, the below Enterprise IDs are already set up. If you use a new host, your Windows System Administrator will need to configure these NOTE: For UCPath, the below Enterprise IDs are already set up. If you use a new host, your Windows System Administrator will need to configure these " Beatrice Cardona on 03/17/15 11:37 AM Userid Directory Access Row 40 Started by Beatrice Cardona on 03/17/15 11:37 AM UCB home directory = E:\FTPSRoot\ Beatrice Cardona on 03/17/15 11:37 AM If there is a Firewall in place at the location, open a Work Request to the location Network Adminis Row 48 Started by Beatrice Cardona on 03/17/15 11:37 AM GoAnywhere Gateway proxies are as follows: PROD - pc-mftgw-prod-01-b.ist.berkeley.edu:9102 (outgoing port) IP = QA - pc-mftgw-qa-01-b.ist.berkeley.edu:9102 (outgoing port) IP = DEV - pc-mftgw-dev-01-b.ist.berkeley.edu:9102 (outgoing port) IP = Beatrice Cardona on 03/17/15 11:37 AM Generate Public and Private Keys and share with the Destination Party Row 50 Started by Beatrice Cardona on 03/17/15 11:38 AM Store keys on GoA Server and Destination Servers Beatrice Cardona on 03/17/15 11:38 AM Open a UCOP Mainframe Service-Now RACF request. Row 52 Page 7 of 9

8 Started by Beatrice Cardona on 03/17/15 11:38 AM The PROD RACF Group is: PCMFTP ie. APP.* (PROD) The QA RACF Group is: PCMFTQ ie. APPQ.* (QA) The DEV RACF Group is: PCMFTD ie. APPD.* (DEV) Beatrice Cardona on 03/17/15 11:48 AM If this FTP is to or from the UCOP Mainframe (and this is the first such request for this application), the App owner opens a UCOP Mainframe Service- Now request for RACF HLQ access to the GoA UserID. (Mainframe host = uccmvsb). This is to request file level authorization to the GoA UserID to allow it to read or write the Mainframe File to be picked up or placed on the mainframe. Beatrice Cardona on 03/17/15 11:38 AM Configure an Application-Specific Services Userid and Password Row 55 Started by Beatrice Cardona on 03/17/15 11:38 AM Note: Ex: Format PP1_Fidelity or PP1_BofA, or UCRS_Fidelity, etc. Beatrice Cardona on 03/17/15 11:39 AM If a GoA trigger file process is required, the Campus liaison configures a GoA Services userid and password based on a template. Usually used for files inbound to GoA. Beatrice Cardona on 03/17/15 11:38 AM Configure Services Trigger Row 56 Started by Beatrice Cardona on 03/17/15 11:39 AM Note: The GoA Services Trigger Name = GoA Director Project Name = GoA Job Name Beatrice Cardona on 03/17/15 11:39 AM If a GoA trigger file process is required, the Campus liaison configures a GoA Services Trigger based on a template. Usually used for files inbound to GoA. Beatrice Cardona on 03/17/15 11:39 AM Configure GoA Director Resources Row 58 Started by Beatrice Cardona on 03/17/15 12:41 PM FTPS Requires ftps server on host (available on Unix or Windows systems) Defaults = Passive Mode, Explicit SSL, TLS Security Protocol Note: Use password or certificates Beatrice Cardona on 03/17/15 12:41 PM SFTP Requires ssh server on host (usually available on unix systems) Note: Use ssh keys or password Beatrice Cardona on 03/17/15 12:41 PM Configure Director Projects (The Jobs that are going to run) Row 59 Started by Beatrice Cardona on 03/17/15 12:44 PM Single File Transfer (MVS/SFTP/FTPS) Defaults: Ensure these are appropriate for this IT Business Partner's file transfer: fails if file does not exists Page 8 of 9

9 source file is unchanged by default (if applicable, change the default) set source file variables at top of Project (Source File is the GET File) set destination variables at top of Project (Destination file is the PUT File) if applicable, set move variables at top of Project to rename source files Multiple File Transfer usually based on wild-card inclusion (MVS/SFTP/FTPS) Defaults: Ensure these are appropriate for this IT Business Partner's file transfers: succeed if file does not exists source file is unchanged by default (if applicable, change the default) set source file variables at top of Project (Source File is the GET File) set destination variables at top of Project (Destination file is the PUT File) if applicable, set move variables at top of Project to rename source files Beatrice Cardona on 03/17/15 12:44 PM Configure Control-M Jobs Row 61 Started by Beatrice Cardona on 03/17/15 11:46 AM Liaison configures Control-M jobs based on templates. Control-M Job Name = GoA Project Name Beatrice Cardona on 03/17/15 11:46 AM Page 9 of 9