This article explains how the Call Home security design on IBM Power protects your environment. We’ll describe what this means for your teams when you enable Call Home.
Outbound‑only, client‑initiated connections
Call Home connections are always initiated by your Hardware Management Console (HMC). IBM never connects into your network remotely. This means your firewallsonly allow outbound HTTPS to IBM when the HMC needs to report a serviceable event or send periodic health and inventory.
Modern TLS with strong bulk encryption
Every Call Home transmission is protected in transit. The HMC negotiates modern TLS (1.2 or later) and then encrypts diagnostic packages using strong ciphers before they’re received by IBM’s Service Delivery Centre. For you, this means that even if traffic is observed on the wire—across the internet or through a proxy - it is unreadable and tamper‑resistant. Keeping the HMC up to date ensures older, weaker ciphers are disabled so your security remains current without extra effort.
Simplified connectivity via esupport.ibm.com
Connectivity is intentionally simple: your internet policy can target a single DNS host—esupport.ibm.com—over port 443. IBM’s front‑end Call Home proxy routes that connection inside IBM to the right support services. The fewer destinations your firewall and monitoring systems have to manage, the lower the security concerns. . It also makes compliance reviews easier because you can point to one controlled, audited path.
Explicit data minimization — no application data
Call Home was built to send only what support needs: fault logs (FFDC), inventory and configuration (VPD), health and utilization metadata, and your designated contact details. It does not send application data or business content. That design choice matters: the information provides IBM with enough context to identify and resolve issues quickly, but it is not the kind of data that would expose customer records, intellectual property, or transactional payloads. Use a distribution email and phone number so contact details are service‑team based rather than tied to individuals.
Retention and access controls at IBM
Support data has a lifecycle. Problem‑specific data is retained only for the duration of the case and a short period after closure, while periodic health and inventory may be stored longer to improve recommendations and product quality. Access to this data is limited to authorized IBM support personnel and stored on secured systems. In risk terms: less data, kept for less time, accessible to fewer people—resulting in a narrower exposure window.
Enterprise controls: proxy and network segmentation
If your organization requires central control, HMC traffic can be routed through your corporate proxy (supporting the CONNECT method) with optional authentication and certificate handling. Inside your environment, you can also place HMC discovery and peer coordination traffic on private VLANs, keeping it separate from user segments. These options align the Call Home design with zero‑trust and least‑privilege principles you already use elsewhere, without complicating day‑to‑day
operations.
How these controls work together to protect Power data
Outbound‑only communication removes inbound exposure; modern TLS and strong encryption secure data; a single DNS point reduces security concerns; the data model itself minimizes what leaves your premises; and retention plus role‑based access limits how much data exists, for how long, and who can see it. With optional proxying and network segmentation, you get added visibility and isolation that align with enterprise security policies—all while accelerating time‑to‑resolution for Power incidents.
What additional questions do you have about Call Home? IBM experts and peers will respond with practical guidance and examples, and your feedback will shape upcoming content in this series. Ask your questions below or join the conversation in the following topic groups: Ask your questions here
#IBMPower#Automation