Update runtime environment to use secure TCP communication (Configuration Manager)

Use Configuration Manager to update your runtime environment to use secure TCP communication.

Before you begin

If you are using a TCP protocol that is non-secure (IP.PIPE, IP6.PIPE) and want to update your runtime environment to use a secure TCP protocol (IP.SPIPE, IP6.SPIPE), you must modify settings for the runtime environment by using Configuration Manager or PARMGEN. This task describes the process using Configuration Manager.

Note: If you use PARMGEN, see Update runtime environment to use secure TCP communication (PARMGEN).

For more information about configuring secure communication using Configuration Manager, review the following related topics:

IBM Z Monitoring Configuration Manager: Communication between monitoring components
IBM Z Monitoring Configuration Manager: Runtime environment (RTE) parameters introduced by Configuration Manager

Before you begin this task, complete the following steps:

About this task

To change the TCP protocol that your runtime environment uses, you must modify the communication protocol setting for both the Tivoli Enterprise Monitoring Server and the monitoring agents. Optionally, you can also modify the ports that are used, if you want to use a port other than the default secure communications port, 3660.

You will use the following parameters when updating your runtime environment to use a secure TCP communication using Configuration Manager:

Table 1. Parameters for setting secure TCP communication using Configuration Manager
Component	Parameter	Description
Tivoli Enterprise Monitoring Server Monitoring agents	RTE_COMM_PROTOCOLn	Sets the communication protocol of all components in the runtime environment, where `n` corresponds to a number between `1` and `7` to indicate the priority sequence for the communication protocols. The RTE_COMM_PROTOCOLn (n: 1 - 7) parameters set the value of the KDS_TEMS_COMM_PROTOCOLn and Kpp_AGT_COMM_PROTOCOLn parameters.
	RTE_TCP_PIPES_PORT_NUM	Sets the port number for all components in the runtime environment that use the secure TCP over IPv4 communication protocol (IP.SPIPE). The RTE_TCP_PIPES_PORT_NUM parameter sets the value of the KDS_TEMS_TCP_PIPES_PORT_NUM and Kpp_TEMS_TCP_PIPES_PORT_NUM parameters. This parameter is used only if one of the parameters that sets communication protocol choices, *_COMM_PROTOCOLn, specifies the value for this protocol, `IPSPIPE`.
	RTE_TCP_PIPE6S_PORT_NUM	Sets the port number for all components in the runtime environment that use the secure TCP over IPv6 communication protocol (IP6.SPIPE). The RTE_TCP_PIPE6S_PORT_NUM parameter sets the value of the KDS_TEMS_TCP_PIPE6S_PORT_NUM and Kpp_TEMS_TCP_PIPE6S_PORT_NUM parameters. This parameter is used only if one of the parameters that sets communication protocol choices, *_COMM_PROTOCOLn, specifies the value for this protocol, `IPS6PIPE`.
Remote monitoring server	KDS_HUB_TCP_PIPES_PORT_NUM	Well-known port for the hub monitoring server for the IP.SPIPE communication protocol (the TCP/IP protocol that supports Secure Sockets Layer communications over IPV4), specified during configuration of a remote monitoring server. The default port number is 3660.
	KDS_HUB_TCP_PIPE6S_PORT_NUM	Well-known port for the hub monitoring server for the IP6.SPIPE communication protocol (the TCP/IP protocol that supports Secure Sockets Layer communications over IPV6), specified during configuration of a remote monitoring server. The default port number is 3660.

Note: You can set up your runtime environment to use both IP. SPIPE and IP.PIPE concurrently. This configuration might be useful when transitioning from a non-secure protocol to a secure protocol. For a secure environment, it is recommended that you disable the non-secure protocol after transitioning to the secure protocol as soon as possible.

Note: If multiple protocols are specified, you must have a corresponding port assigned for each specified protocol.

The following procedure describes how to specify the use of secure TCP communication (IPSPIPE, IP6SPIPE) for your runtime environment using Configuration Manager.

Procedure

Update the settings for the monitoring server and monitoring agents to use secure TCP communication:
1. In member RTEDEF(rte_name), make the following updates:
  - Assign a secure communication protocol (IPSPIPE, IP6SPIPE) as the first priority protocol. The following example sets the first priority protocol to use secure TCP over IPv4:
```
RTE_COMM_PROTOCOL1           IPSPIPE  * Secure TCP over IPv4
```
    Note: If you use IPv6, set the protocol value to IP6SPIPE.
  - If you want to use a secure communication port other than default port 3660, assign the port number by using the corresponding parameter for the specified protocol (IPv4 or IPv6):
```
RTE_TCP_PIPES_PORT_NUM       3660     * Secure IP.PIPE for IPv4
```
```
RTE_TCP_PIPE6S_PORT_NUM      3660     * Secure IP.PIPE for IPv6
```
2. If this monitoring server is a remote monitoring server, in member RTEDEF(KDS$PARM) or RTEDEF(KDS$lpar), specify the port number of the hub monitoring server by using the corresponding parameter for the specified protocol (IPv4 or IPv6):
```
KDS_HUB_TCP_PIPES_PORT_NUM   3660     * Secure IP.PIPE for IPv4
```
```
KDS_HUB_TCP_PIPE6S_PORT_NUM  3660     * Secure IP.PIPE for IPv6
```
Run the GENERATE action.
Recycle the started tasks for the monitoring server and the monitoring agents.

Example

The following example shows the parameters required for a configuration that specifies multiple protocols. If you are transitioning to a secure protocol from a non-secure protocol, you might use this configuration to add the secure protocol before disabling the non-secure protocol. After all components are communicating securely, you can then disable the non-secure protocol. Note that each specified protocol requires a corresponding port number.

For the monitoring server and monitoring agents:

In member RTEDEF(rte_name):

Use the RTE_COMM_PROTOCOLn parameters to specify the protocols in priority order:

RTE_COMM_PROTOCOL1           IPSPIPE  * First choice: secure TCP over IPv4
RTE_COMM_PROTOCOL2           IPPIPE   * Second choice: non-secure TCP over IPv4

Use the RTE_TCP_*_PORT_NUM parameters to specify corresponding ports, if you want to use values other than the default values:
```
RTE_TCP_PIPE_PORT_NUM        1918     * IP.PIPE for IPv4
RTE_TCP_PIPES_PORT_NUM       3660     * Secure IP.PIPE for IPv4
```

If the monitoring server is a remote monitoring server, in member RTEDEF(KDS$PARM) or RTEDEF(KDS$lpar), use the KDS_HUB_TCP_*_PORT_NUM parameters to specify the ports to use:
```
KDS_HUB_TCP_PIPE_PORT_NUM    1918     * IP.PIPE for IPv4
KDS_HUB_TCP_PIPES_PORT_NUM   3660     * Secure IP.PIPE for IPv4
```