Preparing customer firewalls and proxies for the upcoming infrastructure changes on IBM Electronic Fix Distribution / IBM Fix Central system

Notification

Risk classification

HIPER (High Impact and/or Pervasive)

Risk categories

Function Loss

Subcategories for Informational notifications

Download SW & Drivers

Affected Domain

IBM Electronic Fix Distribution (EFD) / IBM Electronic Customer Care (ECC) / IBM Fix Central

Abstract

IBM completed the implementation of the infrastructure improvements to electronic fix distribution that started on June 4, 2022.

Public internet IP address and hostnames are changing for the IBM servers that support internet delivery of fixes and updates for customer system's software, hardware, and operating system.

This change pertains to all operating systems supported by IBM Electronic Fix Distribution (EFD) / IBM Fix Central system.

Customer action may be required to ensure uninterrupted fix delivery services.

Description

New network connections between your machine and IBM servers are required to keep your ability to order and download fixes and updates for your system's software, hardware, and operating system.

You must configure your firewall and proxy server if you have a firewall in your network, or if your machine must use a proxy server to access the internet.

Recommended Action

Firewall

Ensure as soon as possible that the following DNS names and ports are open on your firewall. If these connections are NOT currently allowed then you must create new firewall rules that allow them to flow - do NOT change or remove existing firewall rules at this point.

Note 1: IP addresses are subject to change. Use DNS names whenever possible.

Note 2: Existing connections to the legacy IBM servers should NOT be blocked because a separate communication will be sent when they are sunset. After that point in time you can remove obsolete firewall rules.

New Fix Ordering Hostname	External IP Address	Protocol	Port(s)
www-40.cpc.ibm.com	170.225.116.13	HTTPS	443
www-50.cpc.ibm.com	170.225.118.13	HTTPS	443
www-203.ibm.com	170.225.118.24	HTTPS	443
www-203.ibm.com	170.225.116.28	HTTPS	443

Existing Fix Download Hostname	New External IP Address	Protocol	Port(s)
delivery01-bld.dhe.ibm.com	170.225.126.67	SFTP	22
delivery01-bld.dhe.ibm.com	170.225.126.67	FTPS	20 + 21 + (65024 to 65535)
delivery01-mul.dhe.ibm.com	170.225.126.68	SFTP	22
delivery01-mul.dhe.ibm.com	170.225.126.68	FTPS	20 + 21 + (65024 to 65535)
delivery03.dhe.ibm.com	170.225.126.25	HTTPS	443
delivery03-bld.dhe.ibm.com	170.225.126.39	HTTPS	443
delivery03-mul.dhe.ibm.com	170.225.126.40	HTTPS	443
delivery04-bld.dhe.ibm.com	170.225.126.45	HTTP	80
delivery04-bld.dhe.ibm.com	170.225.126.45	HTTPS	443
delivery04-bld.dhe.ibm.com	170.225.126.45	SFTP	22
delivery04-bld.dhe.ibm.com	170.225.126.45	FTPS	20 + 21 + (65024 to 65535)
delivery04-mul.dhe.ibm.com	170.225.126.46	HTTP	80
delivery04-mul.dhe.ibm.com	170.225.126.46	HTTPS	443
delivery04-mul.dhe.ibm.com	170.225.126.46	SFTP	22
delivery04-mul.dhe.ibm.com	170.225.126.46	FTPS	20 + 21 + (65024 to 65535)
delivery04.dhe.ibm.com	170.225.126.44	HTTP	80
delivery04.dhe.ibm.com	170.225.126.44	HTTPS	443
delivery04.dhe.ibm.com	170.225.126.44	SFTP	22
delivery04.dhe.ibm.com	170.225.126.44	FTPS	20 + 21 + (65024 to 65535)
download2.boulder.ibm.com	170.225.126.42	HTTP	80
download2.boulder.ibm.com	170.225.126.42	HTTPS	443
download2.boulder.ibm.com	170.225.126.42	SFTP	22
download2.boulder.ibm.com	170.225.126.42	FTPS	20 + 21 + (65024 to 65535)
download3.boulder.ibm.com	170.225.126.24	HTTPS	443
download4.boulder.ibm.com	170.225.126.43	HTTP	80
download4.boulder.ibm.com	170.225.126.43	HTTPS	443
download4.boulder.ibm.com	170.225.126.43	SFTP	22
download4.boulder.ibm.com	170.225.126.43	FTPS	20 + 21 + (65024 to 65535)

Proxy server

If your machine does NOT have direct Internet access with your network configuration then you must make sure that your proxy server is correctly configured to allow these aforementioned connections to flow.

Questions & Answers

Q1) Am I impacted by this change ?

A1: The ability to download fixes from IBM may be impacted by this change under certain conditions such as:

You are using Secure FTP protocols to download fixes such as SFTP or FTPS
You are ordering fixes with dynamic content such as dynamic ISO images
You are ordering newly published fixes or fixes that are under US export control restriction

Q2) Which fix acquisition systems/tools can be impacted by this change ?

A2: The following fix acquisition systems/tools can be impacted by this change:

IBM Fix Central website
IBM Installation Manager tool
Hardware Management Console (HMC) appliance
IBM i Send Program Temporary Fix Order (SNDPTFORD) command
IBM ToolsCenter suite
IBM Bootable Media Creator (BoMC) utility
IBM UpdateXpress System Pack Installer utility
IBM Systems Director
IBM Electronic Service Agent
IBM Tape Diagnostic Tool (ITDT)
IBM TS3000 System Console (TSSC)

Q3) Can IBM ShopzSeries website and z/OS System Modification Program Extended (SMP/E) be impacted by this change ?

A3: Please refer to the specific announcement that was made for them: https://www.ibm.com/support/pages/node/6580101

Q4) Which operating systems can be impacted by this change ?

A4: All operating systems supported by IBM Electronic Fix Distribution (EFD) / IBM Fix Central system, including but not limited to:

AIX
Caldera OpenLinux
DOS
FreeBSD
HPUX
i5/OS
IBM i
Inspur K-UX
iOS
IRIX
Linux
macOS
Novell Netware
OS/2
OS/400
Red Hat Linux
SCO
Solaris
SUSE Linux
Symbian
Turbolinux
Ubuntu
VMware
Windows
z/OS
z/VM

Date first published

05 May 2022

[{"Risk Classification":"HIPER","Line of Business":{"code":"LOB33","label":"N\/A"},"Business Unit":{"code":"BU051","label":"N\/A"},"Product":{"code":"SUPPORT","label":"IBM Worldwide Support"},"ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Tips