Remote access to the ASMI is provided by the redirector service in the
HMC. In this way you gain several things:
1) Super secure access to that part of the system. No other DHCP server
handing out incorrect addresses, no potential denial of service attack,
nothing trying to log in by 'accident' and for sure nothing on that
network that could take over it's IP address or that of the HMC and
break the connection.
2) You need more than just the ASMI user ID and password to get into
ASMI. You ALSO need access to the HMCm a second level of security. This
is especially valuable because you cannot create additional users in
ASMI. There are only two, general and admin. There is no ROB or Larry.
3) You get away from the rather irritating security problems that come
with accessing ASMI from your browser directly. As those FSPs age their
encryption options age and in the case of Power5 machines a current
browser won't even link up unless you play many games. The HMC on the
other hand has said options enabled and therefore, no problem.
And so, I do it this way, and I teach it this way. :-)
- Larry "DrFranken" Bolhuis
On 2/21/2014 2:59 PM, rob@xxxxxxxxx wrote:
There are conflicting recommendations on how to hook up your HMC to your
There are some people who want you to put your FSP on some super secure
network that never leaves your machine room. The theory being it's ok if
the public can access all of your payroll, ERP, engineering, etc data but
it's curtains for the free world if they can get into your system
configuration. Me, I fail to see why the config has to be locked down
more than that data. Keeping it on such a secure network also disallows
you from remote access to ASMI, which I had to use when reattaching an HMC
that lost some of it's cookies. It also makes it rather tough to put a
redundant HMC in another city to access that FSP. I have:
City A: HMC1. Talks to Power1 in City A and Power2 in City B.
City B: HMC2. Talks to Power2 in City B and Power1 in City A.
I kinda suggest setting it up the way you plan on leaving it.
You really might want to take a glance at that hardware info center link I