MQSeries.net :: View topic - RFE - DataPower Secure Restore options for online restores

PeterPotkay · Posted: Wed Apr 01, 2015 4:38 am Post subject:

Link to the RFE, when you can vote for it:
http://www.ibm.com/developerworks/rfe/execute?use_case=viewRfe&CR_ID=68879

Request For Enhancement Title:
DataPower Secure Restore - New Options to make online restores feasible

Description:
Please consider adding options to the secure-restore command so that the DataPower Administrator can:
A. Specify the IP address to assign the appliance during the secure-restore, because the IP address in the secure-backup may not be what you want this restored appliance coming onto the network with.
B. Specify that all MQ Objects (or maybe all non default domains) are set to disabled, because you can't have the MQ objects start talking to MQ as soon as the secure-restore finishes.

Use case:
A new appliance arrives. It is either a replacement for a currently online appliance that needs to be replaced, or maybe its an additional appliance to scale horizontally. You have a secure-backup to use. But you can't upload those files to the appliance until the the appliance is on the network, presumably with a temp IP address. So you first have to get the appliance on the network to get the secure-backup files there, then you have to take off the network to execute the secure-restore. At that point over the serial port via the CLI you can set the IP address to what you actually need (not what is in the secure-backup) and you can stop the MQ objects so they don't steal messages. Then you put the appliance back on the network. All this back and forth on network, off network, on network is much easier said then done in the real world.

We cannot have the secure-restore produce an appliance that comes onto the network with an IP address that conflicts with another online appliance. Or with MQ Objects that come online and prematurely start racing for messages from the MQ queue with the other appliances

Either we need the ability to upload files over the serial port so we can fully configure the appliance 100% post secure-restore and prior to the appliance being placed on the network.

Or, enhance the secure-restore command so that while the appliance is on the network we can initiate the secure-network but have control of what IP address it is restored with, and have control of whether the MQ Objects come online or not automatically. Maybe add additional flags to the secure-restore command, or allow the secure-restore command to be fed a configuration file so as additional things are identified that need control during a secure-restore it can be added in future firmware versions.
_________________
Peter Potkay
Keep Calm and MQ On