Limiting access through port restrictions
Limit access to the server by applying port restrictions.
About this task
You might have to restrict access to specific servers, based on your security requirements. The IBM Storage Protect server can be configured to listen on four TCP/IP ports: two that can be used for either regular TCP/IP protocols or Secure Sockets Layer (SSL)/Transport Layer Security (TLS) protocols and two that can be used only for the SSL/TLS protocol.
Procedure
You can set the server options to specify the port that you require, as listed in Table 1.
| Server option | Port access |
|---|---|
| TCPPORT | Specifies the port number on which the server TCP/IP communication driver is to wait for requests for client sessions. This port listens for both TCP/IP and SSL-enabled sessions. The default value is 1500. |
| TCPADMINPORT | Specifies the port number on which the server TCP/IP communication driver is to wait for
requests for sessions other than client sessions. This
port listens for both TCP/IP and SSL-enabled sessions. The default is the value of
TCPPORT. Use this option to separate administrative client traffic from regular client traffic that uses the TCPPORT and SSLTCPPORT options. |
| SSLTCPPORT | Specifies the SSL TCP/IP port address for a server. This port listens for SSL-enabled sessions only. A default port value is not available. |
| SSLTCPADMINPORT | Specifies the port address on which the server TCP/IP communication driver waits for requests
for SSL-enabled sessions. A default port value is not available. Use this option to separate administrative client traffic from regular client traffic that uses the TCPPORT and SSLTCPPORT options. |
Restrictions:
The following restrictions apply when you specify the SSL-only server ports
(SSLTCPPORT and SSLTCPADMINPORT):
- When you specify the server's SSL-only port for the LLADDRESS on the DEFINE SERVER or UPDATE SERVER command, you must also specify the SSL=YES parameter.
- When you specify the server's SSL-only port for the client's TCPPORT option, you must also specify YES for the SSL client option.