QDIO Accelerator and IP security

When you enable IP security, the TCP/IP stack applies your configured filter policy to IP packets that it receives and sends. Depending on your filter policy, the IP layer might permit packets, deny packets, or protect packets using IPSec. For more information about IP security, see IP security.

QDIO Accelerator processes some packets at the DLC layer, bypassing the IP layer. If such packets were allowed to be routed by QDIO Accelerator, this would prevent the IP layer from performing any special processing for these packets that is required by your filter policy.

When IP security is enabled, sysplex distributor packets are always eligible for acceleration using QDIO Accelerator because the packets are subject to IP filtering at the target stack rather than the distributor stack. However, QDIO Accelerator might not be able to forward routed traffic when IP security is enabled if any of your routed traffic is subject to special processing in your filter policy.

QDIO Accelerator forwards routed traffic only if your IP filter policy and defensive filters explicitly permit all routed traffic without logging. If your IP filter policy and defensive filters do not explicitly permit all routed traffic without logging, QDIO Accelerator does not forward routed traffic and one or more of the following messages is displayed on your console:

• EZD2020A

  TCP/IP issues message EZD2020A if you are currently using the IP filters defined in your TCP/IP profile and one of the following conditions is true:

  • There is no IPSECRULE statement with the ROUTING value Routed or Either to permit routed traffic.
  • The first IPSECRULE statement that permits routed traffic does not permit all source addresses, all destination addresses, all protocols, and all security classes.
  • The first IPSECRULE statement that permits all routed traffic specifies that logging is enabled, or logging is enabled as the default.
• EZD2021A

  TCP/IP issues message EZD2021A if you are currently using the IP filters defined in your policy configuration and one of the following conditions is true:

  • There is no IP filter rule that permits routed IPv4 traffic.
  • The first IP filter rule that applies to routed IPv4 traffic does not permit all IPv4 source addresses, all IPv4 destination addresses, both directions, all protocols, and all security classes.
  • The first IP filter rule that permits all routed IPv4 traffic specifies that logging is enabled, or logging is enabled as the default.
• EZD2022A

  TCP/IP issues message EZD2022A if you are using the Defense Manager daemon (DMD) to manage defensive filter rules, and you have a defensive filter installed that applies to routed traffic.

If you have enabled IP security and you want to allow QDIO Accelerator to forward routed traffic, see Steps to allow QDIO Accelerator to forward routed traffic when IP security is enabled.