Create NWS Configuration (CRTNWSCFG)

Where allowed to run: All environments (*ALL)
Threadsafe: No

The Create NWS Configuration (CRTNWSCFG) command creates a network server configuration and an associated validation list. The network server configuration defines connection security or remote system attributes.

Restrictions:

This command is shipped with public exclude (*EXCLUDE) authority. When this command is shipped, authority is issued only to the security officer. The security officer can grant the use of this command to other users.
You must have input/output system configuration (*IOSYSCFG) special authority to use this command.
To specify a non-default value for the IPSECRULE, CHAPAUT, INRCHAPAUT, or SPCERTID parameters, you must have security administrator (*SECADM) special authority.

Top

Parameters

Keyword	Description	Choices	Notes
NWSCFG	Network server configuration	Communications name	Required, Positional 1
TYPE	Configuration type	CNNSEC, RMTSYS, *SRVPRC	Required, Positional 2
IPSECRULE	IP security rules	Single values: NONE Other values (up to 16 repetitions): Character value, GEN, *REGEN	Optional
INZSP	Initialize service processor	MANUAL, AUTO, *NONE	Optional
SPNAME	Service processor name	Character value, *SPINTNETA	Optional
SPINTNETA	SP internet address	Character value	Optional
SPCERTID	SP certificate identifier	Single values: *NONE Other values: Element list	Optional
	Element 1: Component	COMMONNAME, EMAIL, *ORGUNIT
	Element 2: Compare value	Character value
EID	Enclosure identifier	Single values: *AUTO Other values: Element list	Optional
	Element 1: Serial number	Character value
	Element 2: Manufacturer type and model	Character value
SPNWSCFG	SP configuration name	Communications name	Optional
RMTSYSID	Remote system identifier	Single values: *SPNWSCFG Other values: Element list	Optional
	Element 1: Serial number	Character value
	Element 2: Manufacturer type and model	Character value
DELIVERY	Delivery method	DYNAMIC, MANUAL	Optional
CHAPAUT	Target CHAP authentication	Single values: *NONE Other values: Element list	Optional
	Element 1: CHAP name	Character value, *NWSCFG
	Element 2: CHAP secret	Character value, *GEN
INRCHAPAUT	Initiator CHAP authentication	Single values: *NONE Other values: Element list	Optional
	Element 1: CHAP name	Character value, *NWSCFG
	Element 2: CHAP secret	Character value, *GEN
BOOTDEVID	Boot device ID	Single values: *SINGLE Other values: Element list	Optional
	Element 1: Bus	0-255
	Element 2: Device	0-31
	Element 3: Function	0-7
DYNBOOTOPT	Dynamic boot options	Element list	Optional
	Element 1: Vendor ID	Character value, *DFT
	Element 2: Alternate client ID	Character value, *ADPT
RMTIFC	Remote (initiator) interfaces	Values (up to 4 repetitions): Element list	Optional
	Element 1: SCSI interface	Element list
	Element 1: Adapter address	Hexadecimal value, *NONE
	Element 2: Internet address	Character value
	Element 3: Subnet mask	Character value
	Element 4: Gateway address	Character value, *NONE
	Element 5: iSCSI qualified name	Character value, *GEN
	Element 2: LAN interface	Element list
	Element 1: Adapter address	Hexadecimal value, NONE, SCSIIFC
	Element 2: Internet address	Character value
	Element 3: Subnet mask	Character value
	Element 4: Gateway address	Character value, *NONE
TEXT	Text 'description'	Character value, *BLANK	Optional
AUT	Authority	Name, CHANGE, ALL, USE, EXCLUDE, *LIBCRTAUT	Optional

Top

Network server configuration (NWSCFG)

Specifies the name of the network server configuration.

This is a required parameter.

name: Specify the name of the network server configuration to be created.

Top

Configuration type (TYPE)

Specifies the type of network server configuration to be created.

This is a required parameter.

*CNNSEC: Connection security defines the IP Security (IPSec) rule attributes.
*RMTSYS: Remote system defines the hardware and configuration attributes required to boot the server.
*SRVPRC: Service processor defines the attributes used to locate and manage the server.

Top

IP security rules (IPSECRULE)

Specifies the configuration IP Security (IPSec) rules used between the hosting and remote system.

This parameter is only valid when TYPE(*CNNSEC) is specified.

Single values

*NONE: IP Security (IPSec) protocol security settings are not configured.

Other values (up to 16 repetitions)

*GEN: Generate a random pre-shared key.

*REGEN: Automatically generate a random pre-shared key every time the system is varied on.

character-value

Specify a nontrivial pre-shared key up to 32 characters long.

Valid characters are upper case A through Z, lower case a through z, numbers 0 through 9, and the following special characters:

Plus sign
Equal sign
Percent
Ampersand
Left parenthesis
Right parenthesis
Comma
Underline
Minus sign
Period
Colon
Semicolon

Top

Initialize service processor (INZSP)

Specifies how the remote system service processor is secured.

This parameter is only valid when TYPE(*SRVPRC) is specified.

*MANUAL

Security parameters are manually configured on remote system service processor. *MANUAL provides the highest security.

To use this option, it is required that the remote system service processor is pre-configured with a user name, password and certificate. Certificate management will be required. This method is appropriate when connecting to the service processor via public networks to protect the password.

*AUTO

Parameters are automatically configured on the remote system service processor.

*AUTO provides security without requiring pre-configuration of the remote system service processor. The remote system service processor will have certificates automatically regenerated when the certificates are near expiration. This option is appropriate if the interconnecting network is physically secure or is protected by a firewall.

Note: An administrator will need to regenerate the certificate using the Initialize NWS Configuration (INZNWSCFG) command when the service processor certificate has expired, or if a new certificate and password are desired at any time before the certificate expires.

*NONE

Provides no security.

Use this only if the interconnecting network is physically secure.

Note: Some service processors do not support secure connections. Use *NONE for these service processors. Additional information can be found at IBM i integration with BladeCenter and System x at http://www.ibm.com/systems/i/bladecenter/.

Top

Service processor name (SPNAME)

Specifies the remote system service processor host name.

This parameter is only valid when TYPE(*SRVPRC) is specified.

*SPINTNETA: The remote system is identified by the value specified for the SP internet address (SPINTNETA) parameter.

character-value: Specify the remote system service processor host name.

Top

SP internet address (SPINTNETA)

Specifies the remote system service processor internet address.

This parameter is only valid when TYPE(*SRVPRC) is specified.

Notes:

This parameter is required when SPNAME(*SPINTNETA) is specified.

character-value: Specify the internet address of the service processor.
The value is specified in the form nnn.nnn.nnn.nnn , where nnn is a decimal number ranging from 0 through 255.

Top

SP certificate identifier (SPCERTID)

The SP certificate identifier specifies one of three possible fields that identifies the service processor certificate.

This parameter is specified to provide additional validation that the certificate is from the service processor. The contents of the selected field must exactly match the value of the field that was entered when the certificate was generated or requested from a certificate authority.

This parameter is only valid when TYPE(*SRVPRC) is specified.

This parameter is required when INZSP(*MANUAL) is specified and cannot have the value *NONE.

Single values

*NONE: Service processor certificate is not configured.

Element 1: Component

*COMMONNAME: Selects the certificate common name specified when the certificate was generated or requested from a certificate authority. On the remote supervisor adapter II this correlates to the "ASM Domain Name" field used to generate a self-signed certificate or generate a certificate signing request.

*EMAIL: Selects the certificate e-mail address specified when the certificate was generated or requested from a certificate authority. On the remote supervisor adapter II this correlates to the "Email Address" field used to generate a self-signed certificate or generate a certificate signing request.

*ORGUNIT: Selects the certificate organizational unit specified when the certificate was generated or requested from a certificate authority. On the remote supervisor adapter II this correlates to the "Organizational Unit" field used to generate a self-signed certificate or generate a certificate signing request.

Element 2: Compare value

character-value: Specify the certificate component compare value. Enter no more than 255 characters of text, enclosed in apostrophes.

Top

Enclosure identifier (EID)

Specifies the identifying serial number, type and model of the enclosure containing the service processor.

When specified, they are used to identify and verify the system on the network.

Look for these values on the label of the system.

This parameter is only valid when TYPE(*SRVPRC) is specified.

Single values

*AUTO: Automatically retrieve the identifier.

Element 1: Serial number

character-value: Specify the machine serial number.

Element 2: Manufacturer type and model

character-value: Specify the machine type and model.
The value is entered in the form ttttmmm where tttt is the machine type and mmm is the machine model number.

Top

SP configuration name (SPNWSCFG)

Specifies the name of the service processor network server configuration to be used to manage the remote server.

This parameter is only valid when TYPE(*RMTSYS) is specified.

name: Specify the name of the service processor network server configuration.

Top

Remote system identifier (RMTSYSID)

Specifies the identifying serial number, type and model of the remote system. When specified, they are used to locate the remote system on the network.

Look for these values on the label of the system.

Note: The machine type and model may be omitted if the system serial number is unique on the network.

This parameter is only valid when TYPE(*RMTSYS) is specified.

Single values

*SPNWSCFG: Use the serial number and type/model specified in the Enclosure identifier (EID) parameter of the service processor (*SRVPRC) network server configuration.

Element 1: Serial number

character-value: Specify the machine serial number.

Element 2: Manufacturer type and model

character-value: Specify the machine type and model.
The value is entered in the form ttttmmm where tttt is the machine type and mmm is the machine model number.

Top

Delivery method (DELIVERY)

Specifies how the parameters necessary to configure the remote system are delivered.

This parameter is only valid when TYPE(*RMTSYS) is specified.

*DYNAMIC: Parameters are dynamically delivered to the remote system using Dynamic Host Configuration Protocol (DHCP).

*MANUAL: Parameters are manually configured on the remote system using the BIOS utilities (System BIOS or Adapter BIOS - CTRL-Q).

Top

Target CHAP authentication (CHAPAUT)

Specifies the Challenge Handshake Authentication Protocol (CHAP) for the System i iSCSI target to authenticate the remote system iSCSI initiators.

This parameter is only valid when TYPE(*RMTSYS) is specified.

Single values

*NONE: CHAP authentication is not enabled.

Element 1: CHAP name

*NWSCFG: The system will automatically generate a name for CHAP using the Network server configuration name.

character-value

Specify the name you want to use for the Challenge Handshake Authentication Protocol.

Valid characters are upper case A through Z, lower case a through z, numbers 0 through 9, and the following special characters:

Plus sign
Equal sign
Percent
Ampersand
Left parenthesis
Right parenthesis
Comma
Underline
Minus sign
Period
Colon
Semicolon

Element 2: CHAP secret

*GEN: The system will automatically generate a random CHAP secret.

character-value

Specify the secret you want to use for the Challenge Handshake Authentication Protocol.

Note: Target and initiator CHAP secrets must not be the same.

Valid characters are upper case A through Z, lower case a through z, numbers 0 through 9, and the following special characters:

Plus sign
Equal sign
Percent
Ampersand
Left parenthesis
Right parenthesis
Comma
Underline
Minus sign
Period
Colon
Semicolon

Top

Initiator CHAP authentication (INRCHAPAUT)

Specifies the Challenge Handshake Authentication Protocol (CHAP) for the remote system iSCSI initiators to authenticate the System i iSCSI target.

This parameter is only valid when TYPE(*RMTSYS) is specified.

Single values

*NONE: CHAP authentication is not enabled.

Element 1: CHAP name

*NWSCFG: The system will automatically generate a name for CHAP using the Network server configuration name.

character-value

Specify the name you want to use for the Challenge Handshake Authentication Protocol.

Valid characters are upper case A through Z, lower case a through z, numbers 0 through 9, and the following special characters:

Plus sign
Equal sign
Percent
Ampersand
Left parenthesis
Right parenthesis
Comma
Underline
Minus sign
Period
Colon
Semicolon

Element 2: CHAP secret

*GEN: The system will automatically generate a random CHAP secret.

character-value

Specify the secret you want to use for the Challenge Handshake Authentication Protocol.

Note: Target and initiator CHAP secrets must not be the same.

Valid characters are upper case A through Z, lower case a through z, numbers 0 through 9, and the following special characters:

Plus sign
Equal sign
Percent
Ampersand
Left parenthesis
Right parenthesis
Comma
Underline
Minus sign
Period
Colon
Semicolon

Top

Boot device ID (BOOTDEVID)

Specifies the PCI Function Address (Bus/Device/Function) of the iSCSI initiator port in the remote system that will be used to boot from.

Note: Remote systems with more than one iSCSI initiator port installed are required to specify which port will be used to boot from.

This parameter is only valid when TYPE(*RMTSYS) is specified.

Single values

*SINGLE: The single iSCSI initiator port is used on the remote system

Element 1: Bus

0-255: Specify the bus number of the remote system iSCSI initiator port that will be used to boot.

Element 2: Device

0-31: Specify the device number of the remote system iSCSI initiator port that will be used to boot.

Element 3: Function

0-7: Specify the function number of the remote system iSCSI initiator port that will be used to boot.

Top

Dynamic boot options (DYNBOOTOPT)

Specifies the internal Dynamic Host Configuration Protocol (DHCP) Server configuration.

Note: This is an advanced configuration function.

This parameter is used to configure the internal DHCP Server that is part of the iSCSI target host bus adapter (HBA) firmware. It is used to provide IP address and diskless boot parameters for the remote system iSCSI initiator port.

This parameter is only valid when TYPE(*RMTSYS) is specified.

This parameter is only valid when DELIVERY(*DYNAMIC) is specified.

Element 1: Vendor ID

The client and server are pre-configured to a default vendor ID. Network administrators can configure clients to define their own identifying values to convey hardware, operating system or other identifying information. DHCP option 60 described in the IETF RFC 2132 is used for this function.

*DFT: The default vendor ID will be used.

character-value: Vendor ID of the remote system iSCSI initiator port that will be used.

Element 2: Alternate client ID

Used by clients to specify their unique identifier to the server. Each client identifier must be unique among all other client identifiers used on the effective DHCP network to which the client is attached (that is, the client local subnet and any remote subnets reachable using DHCP relay). Vendors and system administrators are responsible for choosing client identifiers that meet this requirement for uniqueness. DHCP option 61 described in the IETF RFC 2132 is used for this function.

*ADPT: The default Client ID consists of the adapter address for the remote system iSCSI initiator port. This value will be used to identify the remote system.

character-value: Specify the Client ID of the remote system iSCSI initiator port that will be used to boot.

Top

Remote (initiator) interfaces (RMTIFC)

Specifies the remote system iSCSI initiator host bus adapter (HBA) configuration. Each iSCSI initiator port has two functions to support a SCSI and a LAN or TCP Offload Engine (TOE) interface.

This parameter is only valid when TYPE(*RMTSYS) is specified.

Note: A minimum of one SCSI interface and one LAN interface is required though they may reside on different initiator ports in the remote system.

You can specify up to 4 repetitions for this parameter.

Element 1: SCSI interface

Specifies the SCSI interface.

*NONE: No SCSI interface is configured for this initiator port.

Element 1: Adapter address

hexadecimal-value: Specify the 12-character hexadecimal adapter address for the initiator port.

Element 2: Internet address

character-value: Specify the internet address for the initiator port.
The value is specified in the form nnn.nnn.nnn.nnn , where nnn is a decimal number ranging from 0 through 255.

Element 3: Subnet mask

character-value: Specify the subnet mask for the initiator port.
The value is specified in the form nnn.nnn.nnn.nnn , where nnn is a decimal number ranging from 0 through 255.

Element 4: Gateway address

*NONE: No gateway address is configured for this initiator port.

character-value: Specify the gateway address for the initiator port.
The value is specified in the form nnn.nnn.nnn.nnn , where nnn is a decimal number ranging from 0 through 255.

Element 5: iSCSI qualified name

*GEN: The system will automatically generate the iSCSI qualified name.

character-value

Specify the iSCSI qualified name for the initiator port.

The following characters are allowed in iSCSI qualified names:

Alphabetical characters A through Z converted to lower case (refer to RFC 3722)
Alphabetical characters a through z
Digits 0 through 9
Period (.)
Dash (-)
colon (:)

Element 2: LAN interface

Specifies the LAN interface.

*NONE: No LAN interface is configured for this initiator port.

Element 1: Adapter address

*SCSIIFC: The SCSI interface adapter address is also configured for the LAN interface.
Note: This value is not allowed when *NONE is configured for this SCSI interface initiator port.

hexadecimal-value: Specify the 12-character hexadecimal adapter address for the initiator port.

Element 2: Internet address

character-value: Specify the internet address for the initiator port.
The value is specified in the form nnn.nnn.nnn.nnn , where nnn is a decimal number ranging from 0 through 255.

Element 3: Subnet mask

character-value: Specify the subnet mask for the initiator port.
The value is specified in the form nnn.nnn.nnn.nnn , where nnn is a decimal number ranging from 0 through 255.

Element 4: Gateway address

*NONE: No gateway address is configured for this initiator port.

character-value: Specify the gateway address for the initiator port.
The value is specified in the form nnn.nnn.nnn.nnn , where nnn is a decimal number ranging from 0 through 255.

Top

Text 'description' (TEXT)

Specifies text that briefly describes the network server configuration.

*BLANK: Text is not specified.

character-value: Specify no more than 50 characters of text, enclosed in apostrophes.

Top

Authority (AUT)

Specifies the authority you are giving to users who do not have specific authority for the object, who are not on an authorization list, and whose group profile or supplemental group profiles do not have specific authority for the object.

*CHANGE: The user can perform all operations on the object except those limited to the owner or controlled by object existence (*OBJEXIST) and object management (*OBJMGT) authorities. The user can change and perform basic functions on the object. *CHANGE authority provides object operational (*OBJOPR) authority and all data authority. If the object is an authorization list, the user cannot add, change, or remove users.

*ALL: The user can perform all operations except those limited to the owner or controlled by authorization list management (*AUTLMGT) authority. The user can control the object's existence, specify the security for the object, change the object, and perform basic functions on the object. The user also can change ownership of the object.

*USE: The user can perform basic operations on the object, such as running a program or reading a file. The user cannot change the object. Use (*USE) authority provides object operational (*OBJOPR), read (*READ), and execute (*EXECUTE) authorities.

*EXCLUDE: The user cannot access the object.

*LIBCRTAUT: The system determines the authority for the object by using the value specified for the Create authority (CRTAUT) parameter on the Create Library (CRTLIB) command for the library containing the object to be created. If the value specified for the CRTAUT parameter is changed, the new value will not affect any existing objects.

name: Specify the name of an authorization list to be used for authority to the object. Users included in the authorization list are granted authority to the object as specified in the list. The authorization list must exist when the object is created.

Top

Examples

Example 1: Security Connection Network Server Configuration

CRTNWSCFG NWSCFG(MYSEC)
          TYPE(*CNNSEC)
          IPSECRULE(*NONE)
          TEXT('Connection security')

This command creates a Connection Security Configuration with no security rules.

Example 2: Service Processor Network Server Configuration

CRTNWSCFG NWSCFG(CAT4SP)
           TYPE(*SRVPRC)
           INZSP(*MANUAL)
           SPINTNETA('1.5.10.75')
           SPCERTID(*ORGUNIT 'ACME Corp')
           EID(RTYM14A 3305R8U)
           TEXT('CAT4SP Service processor')

This command creates a service processor configuration. The service processor is contacted using IP Address 1.5.10.75. The remote system is identified by the serial number RTYMl4A. The service processor is manually secured using a certificate configured with the 'ACME Corp' organizational unit.

Example 3: Remote System Network Server Configuration

CRTNWSCFG NWSCFG(CAT4SVR)
          TYPE(*RMTSYS)
          SPNWSCFG(CAT4SP)
          RMTSYSID(*SPNWSCFG)
          DELIVERY(*DYNAMIC)
  RMTIFC(((111111111111 '1.5.10.10'
           '255.255.255.0' '1.5.10.129' *GEN)
          (1FFFFFFFFFFF '1.5.10.20'
           '255.255.255.0' '1.5.10.129')))
  TEXT('CAT4SVR Service processor')

This command creates a remote system configuration which uses the dynamic delivery method to configure the remote system. The system is identified using the CAT4SP service processor configuration specified by the SPNWSCFG parameter. The iSCSI remote interface for SCSI is configured using an IP address of 1.5.10.10 and a LAN address of 1.5.10.20. The iSCSI qualified name is automatically generated.

Top

Error messages

*ESCAPE Messages

CPF2182: Not authorized to library &1.
CPF90A8: *SECADM special authority required to do requested operation.
CPF96C9: Network server configuration &1 not created.
CPF9870: Object &2 type *&5 already exists in library &3.
CPFA1B8: *IOSYSCFG authority required to use &1.

Top