IBM Z, the next generation of the world’s most powerful transaction system, introduces a breakthrough encryption engine that, for the first time, makes it possible to pervasively encrypt data associated with any application, cloud service or database all the time.
IBM z14 and z/OS V2R3 provide a simple and consumable approach to help customers keep applications and data available, system resources secure, server utilization high, and programming environments adaptable while maintaining compatibility for existing applications.
This is an overview of selected enhancements that are provided by z/OS V2R3 Communications Server that helps build the next-generation infrastructure with high-speed connectivity, availability, and security.
Enhanced security and data protection
- z/OS Encryption Readiness Technology
In z/OS V2R3, Communications Server includes z/OS Encryption Readiness Technology (zERT) to help z/OS administrators to determine which TCP and Enterprise Extender (EE) traffic patterns to and from their z/OS systems meet approved encryption criteria and which do not.
Using zERT, you have a single source of information to determine which traffic is cryptographically protected and which is not. For the traffic that is cryptographically protected, you can determine which cryptographic protocol is used, which cryptographic algorithms are used, the length of the cryptographic keys, and other important attributes of the cryptographic protection. This information is valuable for determining regulatory compliance and for identifying connections that might need stronger cryptographic protection.
With zERT, two new types of z/OS System Management Facility (SMF) records can be collected to build a record of the cryptographic protection of all TCP and EE connections:
- zERT connection detail records provide a complete cryptographic protection history for each TCP and EE connection as that protection is applied.
- zERT summary records summarize, at regular intervals, the repetitive use of security sessions between each client and server.
You can also decide which of these records are recorded to SMF or are made available through a new real-time service for network management applications. Note that support for zERT summary records is planned as a post-GA deliverable in first quarter 2018 with the PTF for APAR PI83362.
- AT-TLS currency with System SSL
The Application Transparent TLS (AT-TLS) support in z/OS Communications Server is updated to support new System SSL functions, including updated NIST and IETF standards for encryption algorithms, use of keys and certificates, and Online Certificate Status Protocol updates.
Simplification, usability, and skills
- Configuration Assistant: Import of existing TCP/IP configuration
With the enhanced TCP/IP technology in Configuration Assistant for z/OS Communications Server, you can import your current TCP/IP stack profiles into the Configuration Assistant, to help you transition to using the Configuration Assistant for your TCP/IP profile management. This support is also available on z/OS V2R2 with the PTF for Configuration Assistant APAR PI66143 and with the PTF for z/OS Communications Server APAR PI63449.
- Configuration Assistant: TCP/IP dynamic reconfiguration using change sets
With the Configuration Assistant for z/OS Communications Server, you can dynamically change an active TCP/IP stack configuration by generating the required VARY OBEY member. This support is also available on z/OS V2R2 with the PTF for Configuration Assistant APAR PI80101.
- HiperSockets L2 and z/VM bridge support
z/OS V2R3 Communications Server plans to include HiperSockets Converged Interface (HSCI) support as a post-GA deliverable in first quarter 2018 with the PTFs for APARs OA53198 and PI83372. HSCI support provides the following benefits:
- Linux on z Systems layer 2 and z/VM VSwitch bridge compatibility
With the z/VM VSwitch bridge support, Linux guests can configure a single IP interface for HiperSockets (HS), providing both internal CPC and external LAN communications. The current z/OS HS support only provides layer 3 connectivity, which is incompatible with this Linux and z/VM environment. The new z/OS V2R3 HSCI support resolves this issue by providing compatibility for both HS layer 2 and Linux guests using HS with the z/VM VSwitch bridge.
- Improved ("hands free") HS usability for z/OS environments
HSCI transparently "converges" an HS interface with your OSA interface, providing transparent and dynamic usage of HS. You can benefit from the following HSCI enhancements:
- As a z/OS network administrator, to get access to HS, you don't need to configure, provision, or operate an HS interface
- A z/OS instance can be relocated to another CPC without making any HS definition changes or taking any operator actions to access HS on the new CPC. Your external LAN is re-created within each CPC providing a single seamless LAN topology within your data center. When your OSA interface is restarted on the new z/OS location, your HSCI is dynamically re-established.
- Enhanced wildcard support for jobname on PORT and PORTRANGE statements
z/OS V2R3 Communications Server enhances the wildcard support for the jobname parameter on the PORT and PORTRANGE TCP/IP configuration statements. Asterisks can be used in any position to indicate zero or more unspecified characters. The question mark can be used in any position to indicate a single unspecified character.
- Communications Server support for enhanced system symbols
z/OS Communications Server supports enhanced system symbols: TCP/IP profile, System Resolver, OMPROUTE, CSSMTP, VTAMLST, and other networking configuration files that support z/OS system symbols can use z/OS system symbols that contain underscores.
- Shared Memory Communications - Direct Memory Access
z/OS V2R3 provides new support for fast, low-latency TCP/IP traffic between LPARs within a CPC by using the Shared Memory Communications - Direct Memory Access (SMC-D) software protocol over firmware-provided Internal Shared Memory (ISM) devices. SMC-D provides substantial performance, throughput, response time, and CPU consumption benefits compared to standard TCP/IP communications over HS. This support is also available on z/OS V2R2 with the PTFs for APARs OA48411 and PI45028.
- Support for new IBM z14 network interface updates
z/OS V2R3 Communications Server provides support for the new OSA-Express6S and RoCE Express2 adapters. z/OS V2R2 and V2R3 support is also provided for both adapters with PTFs.
Scalability and performance
- Improved control over default VTAM VIT options
In z/OS V2R3, Communications Server provides a new VTAM start option that enables improved user control of the default VTAM Internal Trace (VIT) options. Previously, a set of VIT options (API, PIU, SSCP, NRM, MSG, and CIO) was always active and could not be disabled. With the VITCTRL start option, you can enable a new "VIT control" mode to enable or disable any VIT option independently. While this capability is provided, IBM still recommends that the standard VIT options remain enabled to provide first-failure data capture capability for problem diagnosis. This VIT control capability is also available on z/OS V2R1 and z/OS V2R2 with the PTF for APAR OA50271.
- Improved scalability for Sysplex-wide Security Associations (SWSA)
z/OS V2R3 increases capacity for simultaneous IPSec tunnels in a sysplex by increasing the amount of sysplex-wide security association data that can be stored in the EZBDVIPA coupling facility structure, allowing up to 16,384 lists to be configured.
- IPv6 getaddrinfo() API standards compliance
The getaddrinfo (BPX1GAI/BPX4GAI) API in z/OS Communications Server is updated in z/OS V2R3. The new enhancement allows the Resolver to return both IPv4 and IPv6 addresses under certain conditions. The updates are intended to comply with RFC 3493 and the Single UNIX specification version 3.
- Sendmail to CSSMTP bridge
In z/OS V2R3, the sendmail daemon is removed from z/OS, but a new sendmail to CSSMTP bridge is designed to provide a compatible subset of sendmail functions so that z/OS UNIX users can still use the sendmail command to send mail messages with the CSSMTP application. The sendmail to CSSMTP bridge is also available on z/OS V2R1 and z/OS V2R2 with the PTF for APAR PI71175.
For more information about what's new in z/OS V2R3 Communications Server, see z/OS V2R3 Communications Server: New Function Summary.
All statements regarding IBM's plan, directions, and intent are subject to change or withdrawal without notice.