IBM eServer iSeries User manual

iSeries
iSeries Access for Windows
Operations Console
Version 5Release 3
ERserver


iSeries
iSeries Access for Windows
Operations Console
Version 5Release 3
ER s e r v e r


Note
Before using this information and the product it supports, be sure to read the information in
“Notices,” on page 111.
Fifth Edition (May 2004)
This edition applies to version 5, release 3, modification 0of eServer iSeries Access for Windows (product number
5722-XE1) and to all subsequent releases and modifications until otherwise indicated in new editions. This version
does not run on all reduced instruction set computer (RISC) models nor does it run on CISC models.
©Copyright International Business Machines Corporation 2000, 2005. All rights reserved.
US Government Users Restricted Rights –Use, duplication or disclosure restricted by GSA ADP Schedule Contract
with IBM Corp.

Contents
Operations Console .........1
What’s new for V5R3 ...........2
Print this topic..............4
Plan for Operations Console .........4
Plan for your configuration ........4
Plan for your Operations Console install or
upgrade ..............21
Plan for your control panel ........22
Prepare the PC for Operations Console .....28
Complete the setup prerequisite checklist ...28
Complete required prerequisite tasks .....33
Manage Operations Console .........46
Manage your console configuration .....46
Manage your multiple consoles.......57
Change from one console type to another ...65
Manage your local console on anetwork ...77
Common tasks ............86
Troubleshoot Operations Console connections ...92
Troubleshoot status messages .......93
Troubleshoot connection problems ......95
Troubleshoot authentication problems .... 101
Troubleshoot emulator problems ...... 101
Troubleshoot system reference code (SRC) data 102
Troubleshoot remote control panel and virtual
control panel problems ......... 105
Troubleshoot configuration wizard problems 106
Troubleshoot other Operations Console
problems .............. 108
Related information ........... 108
Appendix. Notices ......... 111
Trademarks ..............112
Terms and conditions for downloading and
printing information ...........112
©Copyright IBM Corp. 2000, 2005 iii
||
|
||
||
||
||
|
||
|
||

iv iSeries: iSeries Access for Windows Operations Console

Operations Console
You can interact with your iSeries
™ through aconsole. Use iSeries Operations Console as asystem
console to access and administer your iSeries.
Operations Console is an installable component of iSeries Access for Windows
®
.It allows you to use one
or more PCs to access and control, either remotely or locally, the iSeries console and control panel
functions.
Operations Console uses 5250 emulation provided by either iSeries Access for Windows or IBM
® Personal
Communications to emulate aconsole. To emulate an iSeries control panel, Operations Console provides
agraphical remote control panel or virtual control panel. Operations Console can use alocal area
network (LAN), TCP/IP-based connectivity in addition to direct cable attachment, to enable
communications between an iSeries server and aPC. It supports dial-in connections from remote PCs to
PCs that are directly attached to iSeries servers. These remote PCs can then function as an iSeries console.
If you plan to use Operations Console to manage Eserver hardware, see the Operations Console
information in the IBM eServer
™ Hardware Information Center.
This topic provides you with information and instructions to plan, set up, and manage Operations
Console:
What’s new for V5R3
New Operations Console functions and enhancements.
Print this topic
Print aPDF of all the information included in the Operations Console topic.
Plan for Operations Console
Plan for your Operations Console configuration with scenarios and information on security,
migration, upgrades, and control panels.
Prepare the PC for Operations Console
Complete required setup tasks for your Operations Console configuration with personal checklist.
Manage Operations Console
Maintain and operate Operations Console after you have successfully installed it.
Troubleshoot Operations Console connections
Solve connection, authentication, and emulator problems when using Operations Console.
Related information
View additional information related to Operations Console.
Operations Console support is available on V5R1 and later releases of the OS/400
® operating system. The
only type of PC console that IBM iSeries Models 270, and 8xx support is Operations Console.
Enhanced authentication and data encryption provide network security for console procedures.
Operations Console network connections uses aversion of Secured Sockets Layer (SSL), which supports
device and user authentication but without using certificates.
Before using this information and the product it supports, be sure to read the information in Safety and
Environmental Notices and Electronic Emission Notices for Class Aproducts and Class Bproducts.
©Copyright IBM Corp. 2000, 2005 1

What’s new for V5R3
New functions for Operations Console include:
New functions added to the Operations Console user interface window
The user interface has added functions to make it easier to manage your connections.
vExpanded Properties dialog for making configuration changes and displaying extensive server
information.
–Information relating to the server you are connected to.
–The ability to make all changes to existing configurations using the Configuration tab options.
–The ability to reset the PC’s service device ID password using abutton.
v
Expand /Collapse of aconnection for details on each configured function (remote control panel
or console).
–Primary partitions will show all logical remote control panels selected and authorized to.
–Single-click or double-click selection.
v
Additional fields, which can be moved to any location (except the name field).
vDrag and drop of aconfiguration to auser-selected location in the list.
vSign on to multiple systems or partitions using asingle sign-on dialog.
vSRC history is now available for directly connected remote control panels when adirectly
connected console is part of the same configured connection.
vThe ability to suppress unwanted common dialog windows.
vThe ability to suppress adouble-click to start aconfigured connection.
New functions added to the server for console recovery and debug
Anew function consisting of control panel functions 65 +21 has been created to aid in the recovery
or debug of Operations Console problems. It will allow the user to do the following:
vChange the console mode value.
vClear the LAN adapter’s data used for Operations Console or the service tools server.
vDeactivate and reactivate the LAN adapter’s data used for Operations Console or the service tools
server.
vDump all the flight recorders commonly associated with Operations Console.
This will reduce the need for main storage dumps which causes tremendous impact to the users.
Anew function for when the console mode has not been previously selected.
If the console mode is azero (older systems may have been shipped with this condition and new
partitions would meet this criteria) the user is now prompted to accept the currently connected
console type. This prevents afull install from completing without the selection of the console and
therefore fail on the first unattended IPL.
Operations Console-related configuration options can now be accessed via SST instead of just DST
as in past releases.
Native macro support for Operations Console has been added. This support allows support
personnel to more easily assist with Operations Console problems.
The server now honors the console mode value
The setting of the console mode value will determine what console connectivity will be used. For
example, if you want alocal console via anetwork, you will not be able to start alocal console
directly attached. If afailure occurs, there are now multiple ways to change the console mode and
then be able to connect with the desired console without an IPL, in nearly all cases. This assumes all
hardware is available at that time.
2iSeries: iSeries Access for Windows Operations Console
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|

USB support is now available for Operations Console
Enhancements for Operations Console include:
Improved Configuration Wizard
The Installation Wizard has been simplified.
vAn assumption is made in the wizard to select both the console and remote control panel for
LAN configurations.
–This allows the user to skip the selection of functions.
–Since aserial remote control panel rarely failed to detect and parallel has no actual detection,
the associated wizard screens were removed.
–You can turn off either the console or remote control panel using Properties to achieve the
desired configuration.
v
All local consoles with remote support will default to run attended mode. Again, Properties can
be used to change this to unattended.
Take over and recover the Operations Console connection
It is now possible for LAN-connected Operations Console devices to take over the console from
another device. In addition, when console take over is enabled, the loss of the current console or a
take over, will no longer force the end of the running job. This means that jobs such as installation
of OS/400, performing asystem save, or restore in restricted mode, will not have to be started over
if the connection to the console is lost.
Documentation
The Operations Console topic has been modified to make it easier to find topics of interest.
vThe planning section was rewritten to separate out the standard planning information from the
considerations for abackup console.
vInstructions for setting up the Virtual Control Panel have been added.
vSome basic information is being handled in multiple areas to reduce the need to link the user to
another document.
vThere are more examples for additional clarity for some subjects.
Additional hardware support
The remote control panel cable support for 270 and 8xx models has been reinstated with anew
cable part number (53P5704).
Error messages
Additional error messages have been added to provide more details about the failure and
recommended recovery actions are included.
Discontinued functions for Operations Console include:
vDiscontinued the local console via dial-up connection configuration.
Operations Console no longer supports aPC console directly connecting to an iSeries server via
modem.
vSupport for Windows 98/Me has been dropped.
Operations Console no longer supports Windows 98/Me.
Operations Console 3
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|

Print this topic
To view or download the PDF version of this document, select Operations Console (1,105 KB).
Saving PDF files
To save aPDF on your workstation for viewing or printing:
1. Right-click the PDF in your browser (right-click the link above).
2. Click Save Target As... if you are using Internet Explorer. Click Save Link As... if you are using
Netscape Communicator.
3. Navigate to the directory in which you would like to save the PDF.
4. Click Save.
Downloading Adobe Acrobat Reader
You need Adobe Acrobat Reader to view or print this PDF. You can download acopy from the Adobe
Web site (www.adobe.com/products/acrobat/readstep.html) .
Plan for Operations Console
Before you begin setting up your Operations Console, you should determine how to best configure your
Operations Console:
Plan for your configuration
Planning information assists you in selecting the correct configuration; this topic includes scenarios
and graphics.
Plan for your Operations Console install or upgrade
Planning information assists you in upgrading your Operations Console configurations from
previous releases.
Plan for your control panel
Planning information assists you in selecting aremote control panel or avirtual control panel.
After you complete the planning requirements, you can create asetup checklist that lists the Operations
Console prerequisite. For more information, see Set up Operations Console.
Plan for your configuration
The information in this section illustrates the connectivity allowed by the various types of Operations
Console configurations. The scenarios offer specific configurations to help you select aconsole
configuration. If you plan ahead, you can include additional features in your configuration.
Console planning considerations
This topic will present important considerations for planning an Operations Console for one or more
servers.
Plan for your backup console
Plan for your backup console in the event of hardware or network failures.
Scenarios: Select your configuration
Scenarios help you decide which configuration will work in your environment.
4iSeries: iSeries Access for Windows Operations Console

Prepare for your network environment
Plan for your minimum network configurations.
Secure your Operations Console configuration
Plan for your Operations Console network security.
Prepare for your Operations Console and iSeries Navigator configuration
Plan for how Operations Console works with iSeries Navigator.
Verify Operations Console requirements
Verify you have met the Operations Console hardware, software and cabling requirements.
Important:
vIf you call aservice representative to set up your new server, you must have the PC that you are going
to use as aconsole ready to be connected to your iSeries server. This includes having all cables ready
and all software installed. For example, you must already have your Windows operating system and
iSeries Access for Windows installed on the PC.
vIf you are configuring Operations Console for an OS/400 partition running Linux, see Configure the
LAN console for aguest partition.
Console planning considerations
This topic will present important considerations for planning an Operations Console for one or more
servers.
The following information applies to all servers:
vUnlike previous versions of OS/400, V5R3 will only support the console type currently configured. If
no console type is specified, such as when anew partition is being created, the supporting hardware
IOP found during the creation process takes precedence. If the supporting hardware contains more
than one console type, then the first console workstation to connect will be configured to become the
console.
vThere is also anew console option for V5R3 called Allow console to be taken over by another
console.The default value of the console option is disabled.
–When the option is enabled:
The first Operations Console device connected becomes the console. Additional LAN-connected
Operations Console devices will have aspecial DST signon.
All other 5250-based connections will have the new Console Information Status window.
Console recovery without the loss of the job is available.
–When the option is disabled:
All 5250-based connections will be presented the new Console Information Status window.
Console recovery without the loss of the job is not available.
vOperations Console, both direct attached and network (LAN), and twinaxial workstations, can coexist
as console devices if you remember these rules:
–Only one device can be active at atime.
–Atwinaxial workstation on any twinaxial work station controller with port 0(address 0or 1) or
with port 1(address 0or 1) can become aconsole device if twinaxial console is selected. If twinaxial
console is selected as the console mode then Operations Console devices may not be started.
v
Operations Console allows multiple LAN connections to asingle iSeries server, but only one 5250
session can have control of an iSeries server at atime. An active console is acommand interface to an
iSeries server (5250 emulation) that is currently interacting with the server. More than one Operations
Console device may have data on the screen but only one is truly active.
Operations Console 5
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|

vThe client (PC) also allows multiple local console connections but allows only one local console directly
attached to the server configuration (or local console directly attached to the server with remote access
allowed) for asingle PC.
vThere is amaximum of 26 emulator sessions available per PC.
vIBM recommends that you not put your console on the same IOP as storage devices.
–There may be configurations when this cannot be avoided.
–During very heavy usage of storage devices the console may appear to stop working temporarily
but should resume operation shortly. If the console is placed on the same IOP as storage devices it is
highly recommended that you enable the new console option, Allow console to be taken over by
another console.
The following information pertains to console takeover and recovery:
New for V5R3 is aspecial set of functions that allows aLAN-connected Operations Console to take
control from another console device. Use the following information to help determine what console
devices are best for your work environment and how to deploy these devices to take advantage of the
new functions.
vTakeover is the process used for aLAN-connected console device to take control from the current
console device. The user signed on to the PC that wishes to take control requires special authority and
is initiating the takeover from anew menu. This takeover function is not used for directly attached
consoles.
vRecovery is the process of regaining control of the job running on the console after aproblem with the
console was encountered. The recovery process may be to the same console device or adifferent
console device and may be facilitated by additional work to enable adevice using adifferent
connectivity, except twinax.
When the takeover option is enabled and the device is properly connected, each console capable device
running 5250 emulation, regardless of connectivity, will be presented ascreen of data regardless of
whether or not it is the active console. Starting with V5R3, more than one device will have data on the
screen after the console has been established. There will be no more blank console screens showing
Disconnected when initially connecting adevice. The new function now allows the job at the console to
be transferred to another device without causing loss of data.
This function is accomplished by suspending the data stream to aconsole that loses aconnection or is
being taken over, save further data and then send that data to the next device to become the console,
even if the device is the same former console. Recoverability is essentially taking over the console from
the same or different qualified device regardless of what the former console was doing.
For more detailed information, see Take over or recover an Operations Console connection.
The following information pertains to independent and primary partitions:
vConsole supporting hardware may be required to be located in specific slot locations, based on model.
vMultiple IOPs capable of supporting aconsole workstation can interfere with the selection of the
desired LAN adapter. Consider the following:
–Having asecond IOP on the bus before your intended console adapter card, when the first IOP
contains atwinaxial adapter card, may fail to provide aLAN-connected console. For example, a
model 890 uses eligible card locations C04, and C06 through C10 and if an IOP were placed in C08
and atwinaxial adapter preceded this IOP on the bus then the LAN adapter card located at C09 or
C10 will fail to provide aLAN-connected console. The LAN adapter card must be in alocation
preceding the second IOP, such as C06 or C07.
–Typically, the card location used for Operations Console directly attached configurations, commonly
referred to as the Electronic Customer Support (ECS) slot, is located close to the beginning of the
bus. When the card location is alow number such as C02, then C03 is farther from the beginning of
6iSeries: iSeries Access for Windows Operations Console
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|

the bus than C02. When the card location is ahigher number such as C07, then C06 is farther from
the beginning of the bus than C07. This may not be true for all models and expansion units. When
in doubt contact your service representative.
The following information pertains to amulti-partitioned environment:
vIf you plan to use Operations Console as the primary console or abackup, you must tag the IOP to
support the primary console and Electronic Customer Support, even if you do not plan to use
Electronic Customer Support. For example, if you are planning for Operations Console direct, you
must tag an IOP with the console tag and the Operations Console device tag. The same is true if you
are planning to use Operations console LAN.
vWhen more than one network adapter is available for asingle IOP, the adapter with the lowest bus
address will be chosen for use by Operations Console.
vThe term alternate console is referring to atwinaxial console type located in another IOP tagged as the
alternate console. Operations Console and HMC type consoles do not use resources tagged as the
alternate console. Refer to Plan for your backup console to consider the use of Operations Console as a
console in the event that atwinaxial console is not available.
Note: Tagging the same IOP as both the primary console and the alternate console may result in the
inability to select aconsole. If you have atwinaxial adapter in the same IOP as your primary
console’s adapter, consider the twinaxial adapter to be abackup console, not an alternate
console. You only have to change the console mode to take advantage of the twinaxial adapter
for the console.
Plan for your backup console
This topic covers backup console information you might want to consider to quickly recover from the
unexpected loss of your console. Many system plans include alevel of redundancy to allow for hardware
failures, but some do not consider the console in those plans. Here are some suggestions if you would
like to plan for abackup for your console:
Considerations for abackup console:
vThe adapter location is fixed or at least limited for independent servers or primary partitions. Based on
your server’s hardware requirements you may have limited choices of console types. Try to
accommodate at least one additional console type, if possible.
vConsider using the new take over and recovery option as part of your backup console strategy.
However, the hardware used for the new console mode must exist and be available at the time of
recovery. See Take over or recover an Operations Console connection.
vFor partitions consider:
–In an LPAR environment, the term alternate console is referring to the twinaxial console type
located in another IOP tagged as the alternate console. If afailure of the primary console is detected,
the system will automatically try the alternate console’s IOP. This gives you another level of
protection. Tagging asingle IOP as both the primary console and the alternate console can result in
the inability to select aconsole. Further isolation can be planned by placing the alternate console
IOP on adifferent bus so that failures of the primary console’s bus will not prevent aconsole from
being available.
–Models 270 and 8xx are tagged for aconsole type only at the IOP level. Placing two network
adapters for the same IOP can sometimes make it difficult to determine, in advance, which network
adapter will be used for the console. IBM recommends only one network adapter for the IOP tagged
as the primary console to support Operations Console local console on anetwork. The lowest
addressed network adapter on the bus will be chosen for the console.
–Consider ashared resource environment in which you can allocate and deallocate aconsole
supporting IOP to apartition on apart-time basis. Many work environments rarely need aconsole
device on afull-time basis and you can reduce your initial cost of dedicated hardware by
implementing this concept.
Operations Console 7
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|

–If the load source storage device fails and the system recovery will include the use of the IBM
distribution Licensed Internal Code media instead of acustomer backup, and the system is using
Operations Console (LAN), you may have to use another console type for the initial portion of the
system recovery.
Planning configuration types for backup consoles:
Note: Recovering from the loss of the console depends on many factors. Some of which would be the
model, the hardware resources available, the previous console type, and the new intended console
type. Recovery might consist of repairing the currently failed console or temporarily replacing it
with another console type. Most changes of aconsole type can be performed without the need for
an IPL but there may be circumstances in which an IPL will still be necessary. When using the
console service functions (65+21), console-supporting hardware must be installed and available
prior to performing the function. Any partition tagging of resources must also have been done
already.
If you plan to use Operations Console local console on anetwork (LAN) as abackup to another
console type, the network adapter must be located in aconsole designated slot or properly tagged
IOP. If not previously configured, the BOOTP process will be used to configure the server. See
Prepare for your network environment.
Backup console configuration considerations:
vIf your server is accessed remotely, consider off-site console capability or another connectivity for the
console. Alocal console on anetwork can be backed up with additional local console on anetwork PC.
If the network adapter were to fail, consider alocal console directly attached to the server as abackup.
By changing the console type to alocal console directly attached to the server with remote access, you
can add the ability for aremote PC to become the console.
vIn an LPAR or multiple server environment you will most likely be using multiple local console on a
network configurations on asingle PC as your primary consoles. Consider additional PCs using this
same type configuration. Avoid supporting too many consoles on the same PC if possible. The PC
resources can be easily overwhelmed when supporting multiple consoles and remote control panels.
vConsider multiple local console on anetwork configurations in large environments so that each PC has
acore set of console responsibilities and the overlap coverage of backup configurations with each
other. For example, if you have aPC that supports 10 local consoles on anetwork configuration and
another PC with the same number of primary consoles for another 10 partitions, instead of backing up
each PC with the other’s configuration, you add athird PC and spread the 20 consoles out so that two
PCs back up aportion of each PC’s primary console configurations. Another consideration is a
dedicated PC to be the backup of acertain number of consoles, but not connected until necessary.
vWhen using mostly networked consoles, consider setting up alocal console directly attached to the
server on aPC and place it on arollaway cart with aconsole cable. If you have supporting adapters,
you can quickly roll the cart with the PC near the server or partition in need of the console. After
connecting the cable and changing the console mode value, you have aconsole to replace the currently
failed console. This same concept can be implemented for twinaxial workstations just as easily.
Note: If more than one local console on anetwork is planned, be certain to create additional service tools
device IDs on the server before you start configuring the Operations Console PC. Each PC
connecting to the same target server or logical partition must have aunique service tools device
ID.
In summary, consider as much redundancy as possible for your console needs. If you consider ″what if
this fails″and you have another method to provide aconsole, and also make compromises for the
hardware requirements necessary to overcome the various levels where afailure might occur, you will be
reducing your exposure to acatastrophic console failure condition.
See Managing your multiple consoles for information on the ability to switch between console devices.
8iSeries: iSeries Access for Windows Operations Console
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|

Scenarios: Select your configuration
The following scenarios assists you in choosing your Operations Console configuration.
Scenario: Asingle console directly attached to the server without remote support
Ascenario that discusses asituation in which you may want asingle console attached to the server.
Scenario: Asingle console directly attached to the server with remote support
Ascenario that discusses the ability to dial-in to the console from aremote location.
Scenario: Consoles for multiple servers or partitions
Ascenario that discusses asituation in which you want to manage multiple servers or partitions.
Scenario: Asingle console directly attached to the server without remote support: Your company owns
an iSeries server and you want to use aPC to manage your server. You need one console directly
connected to the iSeries server to physically access the console to manage your iSeries.
For this scenario, you should configure alocal console directly attached to the server.See Set up
Operations Console to complete an interview that will produce achecklist specific to your configuration.
Advantages:
vThe administrator will have access to his console in the event of anetwork failure. With alocal console
on anetwork configuration, anetwork failure will cause you to lose the ability to access your console.
vYou can use this PC to become the iSeries console, to perform control panel functions, or both provided
you have acontrol panel cable, or you set up control panel support. For more information, see Plan for
your control panel.
vThe console can be securely placed behind locked doors in the server room.
Disadvantages:
vYou must be close to the server to manage or access the console.
vAconsole cable and aremote control panel cable is required to support their corresponding functions.
vThis configuration does not support remote connections. If you desire remote connections, see Scenario:
Asingle console directly attached to the server with remote support.
vThis configuration does not support remote control panel function for logical partitions.
vOnly one directly attached configuration is allowed per PC.
Scenario: Asingle console directly attached to the server with remote support: Your company owns an
iSeries server and you want to use aPC to manage your server. You need aconsole connected to this
iSeries server that will allow you to manage the console from aremote location. Then you can perform an
IPL from home over the weekend or check to see if the job you started has completed.
Operations Console 9

For this scenario, configure alocal console directly attached to the server with remote access allowed on
the PC attached to the server.
Then configure aremote console through dial-up on the remote PC. See Set up Operations Console to
complete an interview that will produce achecklist specific to your configuration.
Advantages:
vThe administrator will not have to be near the server to perform console tasks.
vControl panel functions can be performed from aremote location provided they are set up on alocal
console PC.
vYou can use this PC as the iSeries console, to perform control panel functions, or both.
vThe remote console can gain access to the iSeries server with or without operator intervention
depending on your configuration.
Disadvantages:
vOnly one incoming connection is allowed at atime.
vThe local PC must be running Windows NT
®
,Windows 2000, or Windows XP.
vYou need aconsole cable and aremote control cable to support their corresponding functions. For
more information, see Meet Operations Console cable requirements.
vOnly one directly attached configuration is allowed per PC.
Scenario: Consoles for multiple servers or partitions: Your company owns an iSeries server and you
want to use the PC to manage your server. You need to manage multiple iSeries or partitioned servers
from one console. You have asecured network that you can configure your console on.
10 iSeries: iSeries Access for Windows Operations Console

For this scenario, configure alocal console on anetwork.See Set up Operations Console to complete an
interview that will produce achecklist specific to your configuration.
Advantages:
vYou can configure asingle PC to be the console for several different servers or partitions as long as
they are connected to the service connection network.
vThe administrator will not need to be physically near the server to manage the console.
vSecurity features are available to protect your console connections.
vAlocal console on anetwork is the connectivity of choice for partitions in an LPAR environment. For
more information on consoles on partitioned servers, see Plan for logical partitions.
vMultiple PCs can be configured as the console to aserver or partition, but only one can be active at a
time.
Disadvantages:
vNo console is available in the event that anetwork failure takes place unless abackup console is in
place. Configure alocal console directly attached to the server or atwinaxial console for backup. For
more information, see Plan for your backup console.
vYour server will need aseparate LAN card to be used by the console or other service tools. For more
information, see Meet Operations Console hardware requirements.
Prepare for your network environment
This information assists you in identifying and complying with the minimum network configuration
required to set up an Operations Console local console on anetwork (LAN) configuration.
Important: You need to install the LAN adapter for Operations Console according to your iSeries model.
To do this, see Meet Operations Console hardware requirements. If your server is new and you ordered a
local console on anetwork configuration, the adapter should already be configured for use by the server.
The LAN adapter should be dedicated for service tools. It is recommended that you restrict LAN
topologies for LAN-attached local consoles to asingle, physical ring, hub, switch, and router
environment. In the event that the local console on anetwork is used in alarger network topology,
broadcast (DHCP), packet filtering is always recommended. This might be as simple as connecting the PC
and server using acrossover cable or using an inexpensive hub with only the PC and server attached.
When you have only asingle PC or small number of devices connected to the server using ahub and
these devices do not connect to another network or the internet, you can then use any numeric numbers
for addresses. An example would be 1.1.1.x or 10.220.215.x (where xcan be 2through 255 but avoid
x.x.x.1 which might cause problems in some hubs). If however, you have anetwork in which many users
share or the devices go to the internet then you should consult anetwork administrator for addresses.
Operations Console 11
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|

Network security
IBM recommends treating the console over aLAN connection with the same physical security
considerations and controls as alocal console directly attached to the server or atwinaxial console. For
instance, consider configuring alocal console on anetwork in anetwork separate from the main network
(or the company intranet) and strictly control access to the machine acting as the console.
BOOTstrap Protocol
An Operations Console local console on anetwork uses the BOOTstrap Protocol (BOOTP) to configure
the iSeries service IP communications stack. The IP stack configuration plus iSeries serial number is
requested in the Operations Console configuration wizard. The iSeries broadcasts aBOOTP request. The
Operations Console PC replies with the information submitted during the configuration wizard. The
iSeries then stores and uses the configuration information for the service IP communications stack.
Notes:
1. The Operations Console PC must be placed on anetwork that is accessible by the iSeries. This can be
the same physical network or anetwork that permits broadcast packets to flow. This is aone-time
setup requirement; normal console operation does not require this. It is recommended that this setup
occur on the same physical network.
2. The BOOTP request carries the iSeries serial number. The iSeries serial number is used to assign the
IP configuration information. If you are having problems configuring the service IP communications
stack, check that the Operations Console PC is on the same physical network and the iSeries serial
number is correct in the configuration.
3. Operations Console local console on anetwork uses ports 2323, 3001, and 3002. To use Operations
Console in adifferent physical network the router and firewall must allow IP traffic on these ports.
4. The success of BOOTP is dependent on the network hardware used to connect the iSeries and the PC.
In some cases you may need an alternate console device to configure the connection in DST. To use
BOOTP the network hardware used must be capable of AutoNegotiation of Speed and Duplex if
using the 2838 Ethernet Adapter for the console connection.
Secure your Operations Console configuration
Operations Console security consists of service device authentication, user authentication, data privacy,
and data integrity. Operations Console local console directly attached to the server has implicit device
authentication, data privacy, and data integrity due to its point-to-point connection. User authentication
security is required to sign on to the console display.
The following figure is intended to give you an overview of your Operations Console LAN security. The
access password (1), if correct, induces Operations Console to send (2) the service tools device ID
(QCONSOLE) and its encrypted password to the server. The server checks the two values (3), and if they
match, updates both the device and DST with anew encrypted password. The connection process then
validates the service tools user ID and password before sending the system console display to the PC (4).
12 iSeries: iSeries Access for Windows Operations Console
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|

The iSeries console security consists of service device authentication, user authentication, data privacy,
data integrity, and data encryption:
Service device authentication
This security assures one physical device is the console. Operations Console local console directly
attached to the server is aphysical connection similar to atwinaxial console. The serial cable you
use for Operations Console using adirect connection may be physically secured similar to a
twinaxial connection to control access to the physical console device. Operations Console local
console on anetwork uses aversion of Secured Sockets Layer (SSL) that supports device and user
authentication, but without using certificates.
Device authentication
The device authentication is based on aservice tools device ID. Service tools device IDs are
administered in Dedicated Service Tools (DST) and System Service Tools (SST). They consist of a
service tools device ID and aservice tools device ID password. The iSeries is shipped with adefault
service tools device ID of QCONSOLE with adefault password of QCONSOLE. Operations Console
Operations Console 13

local console on anetwork encrypts and changes the password during each successful connection.
You must use the default password to initially set up your server if using alocal console on a
network (LAN).
Note: The device authentication requires aunique service tools device ID for each PC that will be
configured with alocal console on anetwork (LAN) connection.
When using Operations Console local console on anetwork, the configuration wizard adds the
necessary information to the PC. The configuration wizard asks for the service tools device ID, the
service tools device ID password, and an access password.
Note: The access password protects the service tools device ID information (service tools device ID
and password) on the PC.
When establishing anetwork connection, the Operations Console configuration wizard prompts you
for the access password to access the encrypted service tools device ID and password. The user will
also be prompted for avalid service tools user ID and password.
Note: When using the graphical control panel on systems with akeystick, on alogical partition,
setting the mode to secure may require you to use the LPAR menu on the primary to select
another mode.
User authentication
This security provides assurance as to who is using the service device. All problems related to user
authentication are the same regardless of console type. For more information, see Service tools.
Data privacy
This security provides confidence that the console data can only be read by the intended recipient.
Operations Console local console directly attached to the server uses aphysical connection similar to
atwinaxial console or secure network connection for LAN connectivity to protect console data.
Operations Console using adirect connection has the same data privacy of atwinaxial connection. If
the physical connection is secure as discussed under service device authentication, the console data
remains protected. To protect the data, ensure only authorized people enter the computer room.
Operations Console local console on anetwork uses asecure network connection if the appropriate
cryptographic products are installed (AC3 and CE3). The console session uses the strongest
encryption possible depending on the cryptographic products installed on the iSeries and the PC
running Operations Console. If no cryptographic products are installed, there will be no data
encryption.
Data integrity
This security provides confidence that the console data has not changed en route to the recipient.
Operations Console local console directly attached to the server has the same data integrity as a
twinaxial connection. If the physical connection is secure, the console data remains protected.
Operations Console local console on anetwork uses asecure network connection if the appropriate
cryptographic products are installed (AC3 and CE3). The console session uses the strongest
encryption possible depending on the cryptographic products installed on the iSeries and the PC
running Operations Console. If no cryptographic products are installed, there will be no data
encryption.
Data encryption
Enhanced authentication and data encryption provide network security for console procedures.
Operations Console local console on anetwork uses aversion of SSL which supports device and
user authentication but without using certificates.
Administration
Operations Console administration allows system administrators to control access to console functions,
14 iSeries: iSeries Access for Windows Operations Console