IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Automated build with license for DR/BCP Plan

    Posted Sun September 02, 2018 10:19 PM
    Working with a client of ours on the DR/BCP plan. My plan is to have a bare-metal style restore process if we need to rebuild from scratch and then apply the latest snapshot and then we "should" be recovered.

    Looking at the app-metadata config when we build an ISO to restore, and including the policy.

    There is the file: policies/cml/isam/activation/activation3_0_0.xml
    Which contains what products the appliance has been activated for, but no activation keys.

    Ideally I want a very stripped down ISO that just puts the 1.1 management interface back, and then restore everything else from the snapshot.

    Is there a list or XML documentation for the configuration options in the app-metadata apart from the ones includes plus policies structure?

    ------------------------------
    Peter Lambrechtsen
    ------------------------------


  • 2.  RE: Automated build with license for DR/BCP Plan

    Posted Mon September 03, 2018 03:26 AM
    Hi Peter,
    Did you have a look at the silent configuration feature?
    https://www.ibm.com/support/knowledgecenter/SSPREK_9.0.5/com.ibm.isam.doc/admin/concept/con_silent_config.html
    Starting from this step, the appliance has the minium needed configuration. The appliance has now the needed network interface(s).
    You can start from there to build your environment with the REST interfaces.
    Applying the activation keys an also been done via REST.
    Manipulation of the REST APIs can be done with an Ansible playbook for example.
    Hope this help

    ------------------------------
    Emmanuel
    ------------------------------

    Original Message


  • 3.  RE: Automated build with license for DR/BCP Plan

    Posted Mon September 03, 2018 06:54 AM
    Hi Peter,

    I'm not aware of any additional documentation on the content of the bootstrap ISO beyond what is in the product docs.

    I'm pretty sure that activation state is part of the snapshot.  If that's the case then wouldn't that be enough to give what you need - or am I missing something?


    Jon.

    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------

    Original Message


  • 4.  RE: Automated build with license for DR/BCP Plan

    Posted Mon September 03, 2018 08:54 AM
    Hi Peter,

    Emmanuel's suggestion is the best course of action. You have probably seen by now that you can handcraft a silent config ISO by manually authoring the app-metadata file. Ideally you would use this to boot a fresh ISAM VM with the required management IP address and once the REST APIs are available use them to configure the VM - be it completely from scratch or by uploading and applying your backup snapshot. 

    Regarding the "Include system policy" option, this is now more or less obsolete and was useful back before we had complete documented coverage of all the REST APIs required to configure ISAM from scratch.

    If you are still curious, the policy information included when "Include system policy" is checked is actually quite minimal, see the exclusions in this topic. The format of the policy information XML found in the ISO is not documented and changes between versions - I would not recommend attempting to modify or author it manually.

    ------------------------------
    Keiran Robinson
    ISAM Development Team
    ------------------------------

    Original Message