Configuring the Enterprise Connector for Illumio instances

You can configure the EC for Illumio gateway with one or more agents on multiple LPARs; the gateway also serves as an agent on the LPAR where it runs.

Alternatively, you can configure a stand-alone environment where the gateway serves as an agent on a single LPAR.

The different EC for Illumio installation instances require the following configuration settings:

Configuration parameter blocks

The following sample configuration members are located in the RSSSAMP data set:

• Gateway: ECIGPARM
• Agent: ECIAPARM
• (SPE2404)Stand-alone: ECISPARM

The configuration members contain the following parameter blocks:

Configuration parameters syntax

You must conform to the following rules while specifying the parameters in the configuration data set:

• Only one parameter is allowed on each line and can start in any position on that line.
• Parameters must be specified in full and are not case-sensitive except for hierarchical file system (HFS) path names.
• A line with an asterisk * in the first position is treated as a comment.
• RSS parameters support standard z/OS ampersand-prefixed (&) variables (for example, &SYSNAME).
• (SPE2507) You can include static and dynamic system symbols in the parameters. For more information, see Using static and dynamic system symbols in parameters.

Using static and dynamic system symbols in parameters

(SPE2507)

System symbols act as placeholders and are replaced by substitution text (a character string) to maintain unique values in your shared parameter library definitions (accessible to multiple systems). There are two types of system symbols:

• Static system symbol—The substitution text for these symbols are either system-defined or defined in the IEASYMxx member via the SYMDEF subcommand processing. Static system symbols are set during IPL (Initial Program Load) and do not normally change.
• Dynamic system symbol—The substitution text for these symbols can change in real time at any point in an IPL and it is available via the IBM ASASYMBM or ASASYMBF service. You can use dynamic system symbols to build dynamic paths and file names.

Static or dynamic system symbols that you use must be defined in the "z/OS MVS Initialization and Tuning Reference" manual.

The following table lists commonly used dynamic system symbols:

For more information about system symbols, see the "z/OS MVS Initialization and Tuning Reference" manual.

Configuration parameters

The following table describes the configuration parameters:

FlowLink support

The product samples TCP/IP packets on z/OS and sends the trace data over UDP to Illumio FlowLink.

You must define the following code to enable FlowLink support.

Sample configuration for FlowLink support

Resources required for capturing FlowLink data

To capture the information about traffic flows, EC for Illumio makes requests to network management interfaces (NMIs) in z/OS Communications Server. EC for Illumio processes the information retrieved from the NMI and sends it to Illumio FlowLink.

(SPE2504)EC for Illumioadds a timestamp to the FlowLink records sent to Illumio PCE. The timestamp displays the local time and the UTC offset, of the LPAR from which Illumio FlowLink collects network traffic, in the following format:

localDateTlocalTime+-utcOffset

localDate is the local date in YYYY-MM-DD format, localTime is the local time in HH:MM:SS format, and utcOffset is the UTC offset in HH:MM format. The plus sign (+) before the UTC offset indicates that the time zone is ahead of UTC and the minus sign (-) indicates that the time zone is behind UTC.

Various SAF resources control access to the NMI. For more information about these resources, see z/OS Communications Server IP Programmer’s Guide and Reference.

The EC for Illumio started tasks require READ access to the following resource names in the SERVAUTH class:

• EZB.TRCCTL.sysName.tcpName.OPEN
• EZB.TRCCTL.sysName.tcpName.PKTTRACE

The NMI requires that a profile protecting these resources exists. If no profile exists, EC for Illumio cannot run the required functions in the NMI.

If you have multiple TCP/IP stacks, make sure that you have assigned suitable permissions for all system names and TCP/IP stack job names where EC for Illumio is running.

zERT summary records processing

(SPE2404)

EC for Illumiocollects z/OS Encryption Readiness Technology (zERT) summary records (SMF 119 subtype 12 records) and stores them in the product's internal database across EC for Illumio sessions. If you COLD start the instance, the product clears the zERT summary records from the database at startup.

You can analyze the collected zERT summary records on the zERT Records menu on the web interface. You can use this menu to perform the following actions:

• Determine which connections use encryption
• Identify which jobs and users are using connections
• View the ports being used

Using summary records instead of connection detail records reduces the volume of records produced. The records are produced regardless of the SMF collection parameters in your SYS1.PARMLIB data set.

To enable zERT summary records support

1. Specify the following parameters in your TCP/IP profile data set, SYS1.TCPPARMS(ZERT):
   • GLOBALCONFig ZERT AGGregation
   • NETMONitor ZERTSUMmary
2. Run the following command:
   V TCPIP,TCPIP,OBEY,SYS1.TCPPARMS(ZERT)

To configure EC for Illumio for collecting zERT summary records

Specify the following zERT Settings block in your agent (ECIAPARM) or stand-alone (ECISPARM) configuration member. You do not have to specify the zERT Settings block in your gateway configuration member (ECIGPARM).

SyslogD analysis

When the Illumio rules deny a TCP or UDP packet, the product continuously monitors the SyslogD log for the DENY conditions. Traffic Regulation Manager Daemon (TRMD) writes the log analysis messages to a dynamically allocated SYSOUT dataset with the DD name as ERRLmmdd, and the dataset re-allocates daily.

You must define the following code to enable SyslogD analysis.

Sample configuration for SyslogD analysis

Configuration export

You can use EC for Illumio to export TCP/IP interface and service data on z/OS to a flat file. The product can use the information in the flat file to create access control lists (ACLs), workload profiles, and service profiles on the Illumio PCE. If you predefine the flat file, then specify RECFM=VB and LRECL=6144. If you do not predefine the flat file, then it is dynamically allocated.

For more information about generating a configuration export, see the following topics:

• To export interface and service data from the TSO/ISPF user interface
• To export interface and service data from the web-browser interface