Re: how to operate an HMC

[DrFranken <midrange@xxxxxxxxxxxx>]

Rob

	Remote access to the ASMI is provided by the redirector service in the 
HMC. In this way you gain several things:

1) Super secure access to that part of the system. No other DHCP server 
handing out incorrect addresses, no potential denial of service attack, 
nothing trying to log in by 'accident' and for sure nothing on that 
network that could take over it's IP address or that of the HMC and 
break the connection.
2) You need more than just the ASMI user ID and password to get into 
ASMI. You ALSO need access to the HMCm a second level of security. This 
is especially valuable because you cannot create additional users in 
ASMI. There are only two, general and admin. There is no ROB or Larry.
3) You get away from the rather irritating security problems that come 
with accessing ASMI from your browser directly. As those FSPs age their 
encryption options age and in the case of Power5 machines a current 
browser won't even link up unless you play many games. The HMC on the 
other hand has said options enabled and therefore, no problem.

And so, I do it this way, and I teach it this way. :-)

        - Larry "DrFranken" Bolhuis

www.frankeni.com
www.iDevCloud.com
www.iInTheCloud.com

On 2/21/2014 2:59 PM, rob@xxxxxxxxx wrote:
> There are conflicting recommendations on how to hook up your HMC to your
> FSP.
> There are some people who want you to put your FSP on some super secure
> network that never leaves your machine room.  The theory being it's ok if
> the public can access all of your payroll, ERP, engineering, etc data but
> it's curtains for the free world if they can get into your system
> configuration.  Me, I fail to see why the config has to be locked down
> more than that data.  Keeping it on such a secure network also disallows
> you from remote access to ASMI, which I had to use when reattaching an HMC
> that lost some of it's cookies.  It also makes it rather tough to put a
> redundant HMC in another city to access that FSP.  I have:
>
> City A:  HMC1.  Talks to Power1 in City A and Power2 in City B.
> City B:  HMC2.  Talks to Power2 in City B and Power1 in City A.
>
> I kinda suggest setting it up the way you plan on leaving it.
>
> You really might want to take a glance at that hardware info center link I
> sent you.
>
> Rob Berendt