Configuring Fibre Channel Endpoint Security for Mainframe

To configure Fibre Channel Endpoint Security for Mainframe, stop the I/O operations from all hosts or LPARs for the target channel paths, and then take the channel paths offline from the hosts. When the channel path is brought online after enabling Fibre Channel Endpoint Security for Mainframe, port authentication and encryption of data-in-flight between the host and the storage system are established. Use the following procedure to configure the settings.

For more information about the CCI commands and the options, see the Command Control Interface Command Reference.

Cautions:

The connections must be disconnected from all hosts on the target ports for which Fibre Channel Endpoint Security for Mainframe is configured. Use the following procedure to take the channel paths connected to the target ports offline from the host before the operation.
If the host is connected to multiple ports, taking all channel paths offline on all ports collectively at once might cause the system outage. To configure Fibre Channel Endpoint Security for Mainframe, divide the target ports into multiple groups, and then configure the settings for each port group separately. For example, if the host is connected to six ports, divide them into two groups of three ports each, and then configure the settings for each port group separately.
If channel paths remain still online without going offline even after taking channel paths offline, use the following procedure to configure the setting for each port separately as a last resort. Taking offline on multiple ports that could not be taken offline collectively at once might cause a system outage. Automatic recovery of channel paths left still online after the operation is not guaranteed.

Make sure to stop I/O operations to the target ports, and then take all channel paths connected to the target ports offline from the host.

Determine the target FICON® ports for which Fibre Channel Endpoint Security for Mainframe is configured. If the host is connected to multiple FICON® ports, performing this configuration procedure on all FICON® ports at once might cause a system outage. For this reason, divide the target FICON® ports into multiple groups, and then perform the following procedure for each port group.

Verify the host connected to each FICON® port in the target port group, and then take the channel path offline.

Repeat steps (a) through (c) for each FICON® port in the target port group. If the channel path offline is complete normally, perform step 2 to configure the batch settings. If the channel path offline is not complete normally, verify that the instructions for taking channel path offline are correct, and then retry the operation. If the channel paths remain still online without going offline, perform step 3 to configure the individual settings as a last resort.
1. Verify the host connected to the FICON® port and the channel path IDs of the host.
  
  Use the raidcom get port -port <port> -key login_mf_host command in CCI to check the login status of the FICON® port.
  
  Check the host connected to the FICON® port, and then verify the channel path IDs of the host connected to the FICON® port by referring to the configuration between the host and the storage system managed on the site. Repeat steps (b) and (c) for each host connected to the storage system and each channel path ID.
2. Repeat the following operations for each LPAR in the host.
  
  Stop the host I/O operations from the channel path ID identified in step (a), and then take the channel path offline between the target channel path ID and the storage system.
3. Verify the status of the channel path offline operation.
  
  Use the raidcom get port -port <port> -key login_mf_host command in CCI to check the login status of the FICON® port.
  
  If no hosts remain connected to the target FICON® port, perform step 2 to configure the batch settings.
  
  If any hosts remain connected to the target FICON® port, perform step (b) again. If no hosts remain connected to the target FICON® port after retrying step (b), perform step 2 for the batch configuration. If hosts still remain connected even after retrying step (b), perform step 3 for the individual configuration.
4. For FICON® ports targeted for batch configuration, perform step 2. For FICON® ports targeted for individual configuration, perform step 3.
For the FICON® ports targeted for batch configuration, configure Fibre Channel Endpoint Security for Mainframe, and then bring the channel paths online. Step 2 applies to batch configuration of FICON® ports. For individual configuration, perform Step 3.
1. Configure Fibre Channel Endpoint Security for Mainframe for all FICON® ports targeted for batch configuration.
  
  Use the raidcom modify port -endpoint_security command in CCI for the configuration. Do not specify the -forcible option. If the settings end abnormally, take actions by referring to Troubleshooting FICON® encryption, and then go back to step 1 for the target FICON® port.
2. Verify that step (a) ends normally for each target FICON® port by using the raidcom get command_status command in CCI.
  
  If the settings end abnormally, take actions by referring to Troubleshooting FICON® encryption, and then go back to step 1 for the target FICON® port.
3. Restore the channel paths between the host and the FICON® ports to online.
4. Verify that the FICON® ports are configured with the expected security encryption settings for each channel path ID by checking SECURITY in the raidcom get port -key detail command in CCI.
  
  If SECURITY does not meet the expected value, take actions by referring to Troubleshooting FICON® encryption, and then go back to step 1 for the target FICON® port.
5. After the channel paths are brought back online, verify that the channel path status of the volumes on the channel paths is online (PATH AVAILABLE). Use the host commands such as the DEVSERV command in IBM® z/OS® MVS system command to perform this verification. If any channel paths remain offline, take actions by referring to Troubleshooting FICON® encryption.
For the FICON® ports targeted for individual configuration, configure Fibre Channel Endpoint Security for Mainframe, and then bring the channel path online.

Step 3 applies to individual configuration of FICON® ports. For batch configuration, perform Step 2.
1. Configure Fibre Channel Endpoint Security for Mainframe for each target FICON® port.
  
  Repeat steps (b) through (e) for each FICON® port.
2. Use the raidcom modify port -endpoint_security command in CCI for the configuration. Make sure to specify the -forcible option.
  
  If the settings end abnormally, take actions by referring to Troubleshooting FICON® encryption, and then go bak to step 1 for the target FICON® port.
3. Verify that the command in step (b) ends normally by using the raidcom get command_status command.
  
  If the settings end abnormally, take actions by referring to Troubleshooting FICON® encryption, and then go bak to step 1 for the target FICON® port.
4. Restore the channel path between the host and the FICON® port to online.
5. Verify that the FICON® port is configured with the expected security encryption setting for each ID of the channel path connected to the FICON® port.
  
  Check security encryption setting by using SECURITY of the raidcom get port -key detail command in CCI.
  
  If the security encryption setting does not meet the expected value, take actions by referring to Troubleshooting FICON® encryption, and then go back to step 1 for the target FICON® port.
6. After the channel paths are brought back online, verify that the channel path status of the volumes on the channel paths is online (PATH AVAILABLE). Use the host command such as the DEVSERV command in IBM® z/OS® MVS system commands to perform this verification. If any channel paths remain offline, take actions by referring to Troubleshooting FICON® encryption.