The security configuration for the Data Gate synchronization function fails

Diagnosing the problem

The most likely reasons are listed here. Check each one of them to see if it applies:

• The inbound network connection to z/OS is not configured correctly. For example, the host name, the port, or the IP address of the Data Gate instance might be wrong. For more information about the configuration of inbound network connections, see Configuring inbound access to Db2 for z/OS for Data Gate.

  Also make sure that you run the command F PAGENT,REFRESH to let changes to the configuration of the policy agent take effect.

• The outbound network connection from z/OS is not configured correctly. The PKCS12 certificate might be invalid, or the user might have insufficient privileges. For more information about the configuration of outbound network connections, see Encrypting outbound network traffic from Db2 for z/OS to Data Gate
  The PKCS12 certificate is used by the Stunnel service on Cloud Pak for Data. Verify that the Stunnel service is working by running following command on the machine where Cloud Pak for Data is installed:

  openssl s_client -connect <hostname>:<port> -msg

  where

  <hostname>

  Is the host name you specified during the creation (provisioning) of the Data Gate instance.

  <port>

  Is the port number you specified during the creation (provisioning) of the Data Gate instance.

  The expected output of this command is:

  TLS 1.2 Handshake [length 00c3], ClientHello
  ... ...
  <<< TLS 1.2 Handshake [length 003d], ServerHello
  ... ...
  <<< TLS 1.2 Handshake [length 0631], Certificate
  ... ...
  <<< TLS 1.2 Handshake [length 014d], ServerKeyExchange
  ... ...
  <<< TLS 1.2 Handshake [length 0004], ServerHelloDone
  ... ...
  TLS 1.2 Handshake [length 0046], ClientKeyExchange
  ... ...
  TLS 1.2 ChangeCipherSpec [length 0001]
  01
  TLS 1.2 Handshake [length 0010], Finished
  ... ...

• The route is not configured correctly. To check this:
  1. Log in to the infrastructure node of Cloud Pak for Data.
  2. List the existing routes by running the following command:

     oc get route -n $PROJECT_CPD_INST_OPERANDS

  3. Make sure there is only one record for a particular Data Gate instance. For example:

     NAME HOST/PORT PATH SERVICES PORT TERMINATION 
     dg1591202855434 dg.demo.os.ibm.com 
     dg-1591202855434-data-gate-server-svc 11400 passthrough

  The NAME contains the ID (that is, 1591202855434 in the above example) of the Data Gate instance. This ID is also shown in the URL on the web user interface when you open the Data Gate instance, for example:

  https://xxxxx/data-gate/#/details/dg-1591202855434

• Forwarding rule of load balancer is not configured correctly. You need to configure port forwarding rules to redirect access from the specified port Data Gate instance specified to the OpenShift route port(443). If you are using HAProxy, log in to the load balancer node and check the HAProxy configure file /etc/haproxy/haproxy.cfg. If you are using a load balancer other than HAProxy, see the documentation for your load balancer for information about how to configure it.
• The setting for IP forwarding is incorrect. If the port of the Data Gate instance is 443 (the default value), you need not configure IP forwarding (net.ipv4.ip_forward)
  However, if the port of the Data Gate instance is not 443 (for example, the port might be 44443), check if net.ipv4.ip_forward is set to 1 in the /etc/sysctl.conf file. To this end, display the net.ipv4.ip_forward setting in sysctl.conf by running the following command:

  cat /etc/sysctl.conf | grep net.ipv4.ip_forward

  A value of 1 means that IP forwarding is enabled. A value of 0 means IP forwarding is disabled.

  Make sure that net.ipv4.ip_forward = 1 is set.