| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| MQ Cluster Across Firewall |
« View previous topic :: View next topic » |
| Author |
Message
|
| poonchikit |
 Posted: Mon Oct 09, 2006 4:26 am Post subject: MQ Cluster Across Firewall |
 |
|
Novice
Joined: 04 Oct 2006
Posts: 10
|
We've got 2 different network segments separated by a firewall. We want to make the application on 1 segment to access the QM on the other segment. We are faced with 2 choices:
1. Install a QM on the application's server and form a cluster with the existing QM, with the firewall opening the relevant ports.
2. Install a server on the network segment already having a QM. This server will have a QM installed on it and we form a cluster using these 2 QMs. The application on the other network segment should connect to the new server as an MQ client passing thru the firewall.
I would like if there is any potential concerns with the 1st option. |
|
| Back to top |
|
 |
| jefflowrey |
| Posted: Mon Oct 09, 2006 5:08 am Post subject: |
|
|
Grand Poobah
Joined: 16 Oct 2002
Posts: 19981
|
The major difficulty people run into with clusters across network boundaries like this is that clusters want to be fully connected networks.
So if you have QMGRA, QMGRB, and QMGRC on one segment and QMGR1, QMGR2 and QMGR3 on the other network segment... the clustering wants to connect all six queue managers to each other directly.
So that's the downside, is that you might only want or need for QMGRB to talk to QMGR3. And then it gets complicated.
The down side of using a client connection, as your option two, is that you won't be able to do XA without paying for the Extended Transactional Client.
_________________
I am *not* the model of the modern major general. |
|
| Back to top |
|
|
| poonchikit |
| Posted: Mon Oct 09, 2006 4:52 pm Post subject: |
|
|
Novice
Joined: 04 Oct 2006
Posts: 10
|
Thanks.
That means with proper setup of the firewall and the 2 QMs in the 2 network segments can communicate, there should not be any problem.
Solving this, I am wondering if there is any security concern for the QM cluster setup across the firewall. As you know, the main reason why we want to have a firewall is to segregate the network into zones of different secuirty requirements. Say, if the QM (for an EAI Server) on 1 side of the firewall is accessed by other applications, it seems when using cluster queues, a message supposed on this side of the network may appear on the other side's QM, which is used by an application, i.e. other applications messages may appear in this application's QM. This seems to be a security concern if someone has the right to create a cluster queue that may store the reply messages intended to other applications.
What do you think of this? Thanks. |
|
| Back to top |
|
|
|
|
|
| |
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
