The Remote Support Manager automatically configures the internal firewall to allow access to subsystems that have active alerts.
If access is needed to other subsystems, you can manually enable Service Access for those subsystems. In addition, if you have configured
any other SAN devices, they can also be enabled for Service Access.
General information about firewall rules and allowed connections
In order to detect events and report them to IBM the following connections are always permitted.
- Inbound SNMP traps on port 163
- Outbound connections Domain Name Servers (DNS) on port 53.
- Outbound connections to the configured e-mail (SMTP) server
In addition, the following connections are allowed for management and maintenance of the RSM for Storage system.
- Outbound connections to IBM's websites and FTP servers
- Ping requests and responses
- Traceroute requests and responses
- Inbound HTTPS requests
While a subsystem has an active alert, outbound connections to that subsystem are allowed. Outbound connections are also allowed for all devices
that have been placed in "Service Access" mode.
Additional Firewall Configuration
If you have a need to allow access to additional IP addresses, you can edit the rsm-firewall.conf.sample file that is located
in the /etc/rsm directory. Add the IP addresses to this file as described in the sample file.
To activate the changes, rename the rsm-firewall.conf.sample file to be rsm-firewall.conf. Then stop and re-start
the RSM for Storage application using the rsm-stop and rsm-start command line programs. Note: do not stop and re-start
the RSM for Storage application while there are active alerts.
Remember that any addresses placed in the configuration file will be accessible to all local and remote users of the
RSM for Storage system regardless of the firewall settings.
|