RE: iSeries public WEB access, PCI security issues

Often the web suggestions I get try to throw a single point of failure in
there somewhere along the line.
let's see, we'll use
- replicated DB2 databases
- clustered WAS based application servers
- multiple DNS servers
however I cannot use round robin DNS spraying because it could route me to
a WAS or DB2 server that is down. For example, just because I can PING
MYWASSERVER doesn't mean WAS is up, or even HTTP is up. So I get an
intelligent server that checks comm over a certain port. And route
everything through that. So now does it know that MYWASSERVER is
xxx.xxx.xxx.xxx but it now knows that comm is working on port (9231 for
example) and we know that port is used by our WAS application. Only to
find out that such appliance cannot be clustered and is now our new single
point of failure. And my boss says run it on IBM i, that's robust. Well,
yes it is. However we also drop that for an entire weekend once a quarter
to upgrade the OS or put PTF's on it or upgrade hardware or move it from
one location to another or...
So you end up doing stuff like changing DNS manually before you drop the
one server.


Rob Berendt