Connectivity security for Service Advisor

The advanced management module can be configured to send service information data back to IBM. By default the call home function is disabled. Service Advisor requires a set of parameters and contact information to enable the call home function.

Service Advisor only connects to IBM when it is enabled for reporting problems and a problem is encountered. The data is transmitted in a service data capture file that includes inventory and status information. To save and view a service data capture file, see AMM Service Data.

When Service Advisor is enabled, the advanced management module uses a client-provided internet connection to connect to IBM Support. All the communications are handled through TCP sockets, which always originate from the advanced management module, and use SSL to encrypt the data that is being sent back and forth. The advanced management module can be enabled to connect to the Internet through a client-configured proxy server.

The following diagram shows the advanced management module connecting to IBM without a proxy server.

In this setup, the advanced management module connects through the client-provided Internet connection by the default route. For the advanced management module to communicate successfully, your external firewall must allow established TCP packets to flow freely on port 443 (HTTPS).

The following diagram shows the advanced management module connecting to IBM using a client-provided proxy server.

To forward SSL sockets, the proxy server must support the basic proxy header functions (as described in RFC 2616, Hypertext Transfer Protocol 1.1; see http://www.ietf.org/rfc/rfc2616.txt) and the connect method. Basic proxy authentication (RFC 2617, HTTP Authentication: Basic and Digest Access Authentication; see http://www.ietf.org/rfc/rfc2617.txt) can be configured so that the advanced management module authenticates before attempting to forward sockets through the proxy server.

For the advanced management module to communicate successfully, the client's proxy server must allow connections to port 443 and port 80. The proxy server can also limit the specific IP addresses to which the advanced management module can connect.

When the advanced management module with Service Advisor enabled detects a problem for itself or one of the BladeCenter components, a problem report will be called home to IBM. All the information in that report will be temporarily stored. Once the transmission is complete, the advanced management module will no longer provide status information for the opened call. IBM Support will contact you to perform additional problem determination and find a solution. Support Engineers that are actively working on a problem can offload the data for debugging purposes and then delete it when finished.

Ensure that you have addressed the issue of firewall access if you plan to use the Service Advisor feature.

If you plan to enable Service Advisor, you must ensure that your firewall is configured to allow outbound traffic on ports 80 and 443. See Table 1 for a list of the URLs, IP addresses, and ports, that Service Advisor uses to transmit AMM service data to IBM.