Security Of Your Operations Console Configuration - IBM i Series Handbook

Starting with i5/OS V6R1, Operations Console can detect systems that are capable of being configured
|
| with less user interaction. If this condition is detected, the PC and system attempt to exchange
information for a new configuration. If the information exchange is successful, the system uses this
|
information during the setup of the connection at the PC. This reduces mistakes caused by entering the
|
| wrong IP address or the partition ID. This detection can take place only if both the PC and the system are
running V6R1 code. Otherwise, a traditional BOOTP takes place and you must supply all the data for the
|
system.
|
The BOOTP request carries the system serial number and partition ID. The system serial number and
partition ID are used to assign the IP configuration information. If you are having problems configuring
the service IP communications stack, verify that the Operations Console PC is on the same physical
network, and that the system serial number and partition ID are correct in the configuration.
A local console on a network (LAN) uses ports 2323, 3001, and 3002. To use Operations Console in a
different physical network the router and firewall must allow IP traffic on these ports.
The success of BOOTP is dependent on the network hardware used to connect the system and the PC. In
some cases, you might need a different device to configure a console connection using system service
tools (SST). To use BOOTP, the network hardware used must be capable of autonegotiation of speed and
duplex when using the 2838 Ethernet Adapter for the Operations Console connection.
| Although the system and PC can still perform a standard BOOTP operation as described here, in V6R1 a
new function was added to allow the automatic discovery of a connection between the system and a PC.
|
This function, called VSDISCOVER, is a proprietary mechanism used solely for Operations Console. Both
|
| the system and PC listen for a special broadcast frame from the network and when received there is a
negotiation using ports 67 and 68 and the system and PC can use the data exchanged to configure itself,
|
if needed. In addition, the PC creates a configured connection that the user can start a console session
|
| with. This VSDISCOVER function is the default mechanism for configuring a connection. The BOOTP
process will still be used when VSDISCOVER isn't necessary, such as when you already have a
|
configured connection and the network data needs to be reset for some reason.
|
Related reference
"Planning considerations for your backup console" on page 5
Most system plans include a level of redundancy to allow for the event of hardware failures; however,
many people do not consider the console in their plans. To recover quickly from an unexpected loss of
your console, you need to plan for a backup console.
"Operations Console hardware requirements" on page 7
You need to meet the PC and System i hardware requirements for an Operations Console
configuration.

Security of your Operations Console configuration

Operations Console security consists of service device authentication, user authentication, data privacy,
and data integrity.
An Operations Console local console directly attached to the system has implicit device authentication,
data privacy, and data integrity because of its point-to-point connection. User authentication security is
required to sign on to the console display.
The Operations Console client code requires less user interaction than previous releases when you are
|
connecting a local console on a network configuration. By default, you do not need to maintain the access
|
| password unless you need to remain in a manually maintained environment. The system can also
maintain the service tools device IDs. See the Operations Console simplification topic for more details.
|
The system requires the same process to successfully connect, but part of this can be performed by
|
| Operations Console.
14
System i: Connecting to System i Operations Console