Network Configuration

Overview

This chapter describes the network port configuration that must be completed before installing any UKO-related components. The network configuration is a prerequisite for all UKO installations.

Review the port requirements table below to identify which ports you need to reserve based on your planned installation scenario.

Port Requirements by Installation

The following table shows which ports are required for each installation component:

Notes:

• UKO Base Liberty Server and CC Liberty Server are separate server instances and can use different port numbers.
• CC CAT and CC run in the CC Liberty Server and share the same server ports. CC ACSP runs as a standalone server.
• MSDKE has components in both UKO Base and CC servers, requiring both sets of ports.
• The ${CONFIGURATION_PORT} for CC ACSP is used for JMX monitoring.

Port Reservation for UKO Base Installation

This section applies to: UKO Base, MSDKE (UKO Base component)

PORT
${AGENT_PORT} TCP  ${AGENT_STC_NAME}  ; UKO Agent

PORT
${SERVER_NOTLS_PORT}  TCP  ${SERVER_STC_NAME} ; UKO Liberty server HTTP port
${SERVER_TLS_PORT}  TCP  ${SERVER_STC_NAME} ; UKO Liberty server HTTPS port

Port Reservation for Crypto Connect Server

This section applies to: Crypto Connect, CC CAT, MSDKE (CC component)

The Crypto Connect Liberty server requires port reservations. CC CAT runs within the CC Liberty server and uses these same ports.

To reserve the CC Liberty server ports, add the following statements to the TCP/IP PROFILE:

PORT
${SERVER_NOTLS_PORT}  TCP  ${SERVER_STC_NAME} ; Crypto Connect Liberty server HTTP port
${SERVER_TLS_PORT}  TCP  ${SERVER_STC_NAME} ; Crypto Connect Liberty server HTTPS port

Replace:

• ${SERVER_NOTLS_PORT} with your selected HTTP port number (for example, 9081)
• ${SERVER_TLS_PORT} with your selected HTTPS port number (for example, 9444)
• ${SERVER_STC_NAME} with the started task name for the Crypto Connect Liberty server

Note: The CC Liberty server is a separate instance from the UKO Base Liberty server and typically uses different port numbers.

Port Reservation for CC ACSP Configuration Port

This section applies to: CC ACSP

The CC ACSP server requires an additional configuration port for JMX monitoring. To reserve this port, add the following statement to the TCP/IP PROFILE:

PORT
${CONFIGURATION_PORT}  TCP  ${SERVER_STC_NAME} ; CC ACSP JMX monitoring port

Replace:

• ${CONFIGURATION_PORT} with your selected monitoring port number (for example, 9050)
• ${SERVER_STC_NAME} with the started task name for the CC ACSP server

For more information about configuring the ACSP monitoring port, see CC ACSP server monitoring.

AT-TLS Setup (Optional)

This section applies to: All components (optional configuration)

Application Transparent Transport Layer Security (AT-TLS) is a capability of z/OS Communications Server that can create a secure session on behalf of UKO (or other z/OS applications). Instead of implementing TLS in UKO, AT-TLS provides encryption and decryption of data based on policy statements that are coded in the Policy Agent. UKO sends and receives cleartext (unencrypted data) as usual while AT-TLS encrypts and decrypts data at the TCP transport layer.

AT-TLS is activated by specifying the TTLS option in the TCPCONFIG statement block in the TCP/IP profile data. For more information on AT-TLS, see Application Transparent Transport Layer Security data protection in the z/OS Communications Server documentation.

## ----------------------------------------------------------------
# UKO Agent TLS setup 
## ----------------------------------------------------------------
TTLSRule UKO_agent_50050
{
LocalPortRange 50050
LocalAddr ALL
Jobname EKMF
Userid EKMF
Direction INBOUND
TTLSGroupActionRef UKO-AGENT-TLS-GRPACTION
TTLSEnvironmentActionRef UKO-AGENT-TLS-ENVACTION
}
## ----------------------------------------------------------------
# UKO Agent group action
## ----------------------------------------------------------------
TTLSGroupAction UKO-AGENT-TLS-GRPACTION
{
TTLSEnabled On 
Trace 255
}
## ---------------------------------------------------------------
# UKO Agent environment action
## ---------------------------------------------------------------
TTLSEnvironmentAction UKO-AGENT-TLS-ENVACTION
{
TTLSKeyRingParms
{
Keyring TLS-ACCESS
}
TTLSEnvironmentAdvancedParms
{
 ApplicationControlled  Off
 SecondaryMap Off
 TLSV1 Off
 TLSV1.1 Off
 TLSV1.2 Off
 TLSV1.3 On
 SSLV3 Off
}
TTLSCipherParms
{
V3CipherSuites TLS_AES_256_GCM_SHA384
}
HandShakeRole Server
}

IPv6 Setup (Optional)

This section applies to: All components (optional configuration)

Initializing a TCP stack for use with both IPv4 and IPv6 addresses.

To enable TCP/IP for IPv4/IPv6 dual-mode stack:

1. Modify the BPXPRMxx member to define two NETWORK statements, one for AF_INET, and another for AF_INET6.

The following example shows two NETWORK statements in the BPXPRMxx member:

FILESYSTYPE TYPE(INET) ENTRYPOINT(EZBPFINI)
NETWORK DOMAINNAME(AF_INET)
        DOMAINNUMBER(2)
        MAXSOCKETS(12000)
        TYPE(INET)
NETWORK DOMAINNAME(AF_INET6)
        DOMAINNUMBER(19)
        MAXSOCKETS(13000)
        TYPE(INET)
SUBFILESYSTYPE NAME(TCPIP) ENTRYPOINT(EZBPFINI)
        TYPE(INET)

2. To verify that TCP/IP is configured to support a dual-mode environment, enter a d tcpip,,netstat,home command on the z/OS® console. Look for the INTFNAME field that has a value of LOOPBACK6 and verify that the associated ADDRESS field has a compressed colon-hexadecimal IPv6 address of ::1.

The following example shows that TCP/IP is configured to support both IPv4 and IPv6:

d tcpip,,netstat,home
  EZD0101I NETSTAT CS V1R5 TCPIP 034
  HOME ADDRESS LIST:
  LINKNAME: CTC1LINK
    ADDRESS: 9.30.115.135
      FLAGS: PRIMARY
  LINKNAME: LOOPBACK
    ADDRESS: 127.0.0.1
      FLAGS:
  INTFNAME: LOOPBACK6
    ADDRESS: ::1
      TYPE: LOOPBACK
      FLAGS:
  3 OF 3 RECORDS DISPLAYED