Subject: Configuring Call Home on HMC 5.2 Using ssh Instead of VPN

Audience: All

Date: March 19, 2006

HMC V5.2, released in February, allows you to configure call-home to IBM Service using Secure Socket Layer connections. For many customers, this is preferable to using the Internet VPN option.

Here are instructions for configuring outbound communication using SSL:

1. Go to the Remote Support menu under Service Applications.
2. Select the Customize Outbound Connectivity task.
3. Connectivity options include Modem, Internet, Internet VPN and Pass-Through Systems. (Pass-Through Systems are i5/OS partitions.) For SSL connectivity, select the Internet tab.
4. A Note appears in bold face type suggesting going to the Help menu to see if additional firewall configuration is necessary. This refers to a firewall that exists between the HMC and the Internet. This is nearly always the case. If you follow the links for Internet connectivity in the Help text, you will arrive at a screen telling you to allow outbound communications on port 443 for the following IP addresses. You should have four IP addresses open, two for authentication and two for access to IBM Service by geography:
   • 129.42.160.48 and 207.25.252.200 (IBM Service to System Authentication Server)
   • 129.42.160.49 and 207.25.252.204 (Allow HMC access to IBM Service for North and South America)
   • 129.42.160.50 and 207.25.252.205 (Allow HMC access to IBM Service for all other regions)
5. At the top of this screen, you can check a box to make this HMC a call-home server for other HMCs on the same subnet. Notice the limitation that they must be on the same subnet.
6. To enable call-home using SSL, check the box to Allow an Existing Internet Connection for Service.
7. Use the Test button to make sure outbound connectivity is working. During the test, you will see detailed status information showing that sockets have been successfully opened on the remote IBM server.

This new functionality is for outbound communication only. If you desire inbound communication from IBM to your HMC and its managed servers, you would have to choose either modem or Internet VPN as your access method. Additional enhancements in call-home support can be expected in the future

Thanks to Ron Barker for this tip.