240208 Machine Alert for 2817, 2818, 2827, 2828, 2964, 2965, 3906, 3907, 8561, 8562, 3931, 3932

• Document number:

  240208

• Machine type:

  2817, 2818, 2827, 2828, 2964, 2965, 3906, 3907, 8561, 8562, 3931, 3932

• Models affected:

  ALL

• Abstract:

  Reminder: (Action Required) Upcoming Important IP Address Transition For IBM Z and LinuxONE Remote Support Facility (RSF) Call Home Connectivity

Description

As reported previously in Machine Alert Document 231023, on March 1st, 2024 IBM will transition to a single IP address for IBM Z and LinuxONE remote support connections. IBM strongly recommends clients update their network security infrastructure as soon as possible to allow access to the new IP address. Failure to make the required updates by March 1st will disrupt all remote support capabilities with the result that IBM Z and LinuxONE systems will be unable to call home.

For convenience, below is the entirety of the original message:

Description

IBM is making additional updates to the Remote Support Facility (RSF) infrastructure used to support our IBM Z and LinuxONE clients. Public Internet IP addresses for host name esupport.ibm.com are changing for the IBM servers that support call home. Synonymous with the previous updates implemented in April 2023 (Machine Alert Documents 221020 and 230322) , these additional future updates may require configuration changes to your network security infrastructure (firewalls, proxies, etc) to allow outbound connections to new RSF servers from your IBM Z Hardware Management Console (HMC); standalone HMC or hosted within the Hardware Management Appliance (HMA).

On March 1, 2024 IBM will transition to use a single new IP address per IPv4/IPv6 protocols for IBM Z remote support connections. The IP address will replace all existing IP addresses. Activation of the new IP address and discontinuance of the current IP addresses is planned to take place on March 1, 2024. To be prepared for the upcoming change and ensure continuity of call home capabilities, IBM strongly recommends clients update their network security infrastructure as soon as possible to allow access to the new IP address. Access to the current IP addresses must remain in place until March 1, 2024 and can be removed thereafter.

Failure to update network security settings to support the new IP address will result in IBM Z and LinuxONE systems being unable to call home.

Due to technical limitations, a subset of the previously announced new IP addresses did not go into effect. Reference the IP Address information below for the full details of the NEW and CURRENT IP Addresses required for call home connectivity.

IP Addresses for Internet connectivity using IPv4 / IPv6
Internet connectivity to the IBM Service Support System supports access using both the IPv4 and IPv6 protocols. If a firewall is in place between the HMC (or SSL Proxy) and the Internet, it must allow outgoing TCP/IP connections on port 443 from the HMC (or SSL Proxy) to the IBM Service Support System.

Internet connectivity using the IPv4 or IPv6 protocols requires outbound connectivity to the following IP addresses:

* IBM contracts with external parties, and target dates may need to be adjusted. Future announcement will be made if the target date changes.

Host names for using an SSL Proxy server

If an SSL Proxy is used to access the Internet, you can configure the HMC to send an HTTP Connect request to the proxy with either the IP address (as shown above) or using a host name. If you configure it to use a host name, your proxy must accept connections to port 443 on the esupport.ibm.com host name.

Recommended Action

• IBM recommends clients to update their network security infrastructure (firewalls, proxies, etc) as soon as possible and prior to March 1, 2024, to allow call home access using the NEW IP address listed above. Failure to make the required updates will disrupt all remote support capabilities.
• No actions are required:
  • If a firewall is not configured between the HMC (or SSL Proxy) and the Internet
  • If outbound connectivity policies are based on target host name esupport.ibm.com instead of the specific IP addresses.

Please contact your next level of support with questions or concerns.