Electronic Service Agent (ESA) and Electronic Customer Support (ECS) VPN and HTTP Firewall Settings

Starting V7R3 the EDGE server is used. EDGE is a new ECC server environment (esupport.ibm.com) that provides a front-end proxy to the current ECC infrastructure.
EDGE simplifies the IT for ECC consumer products by reducing the number of customers facing IBM servers, enabling IPv6 connectivity, and providing enhanced security. Customers have fewer IBM addresses to open on their firewall. All EDGE internet traffic flows through the EDGE proxy and then fan out to various internal IBM service providers.

To summarize, Edge provides the following advantages over the current infrastructure.

1. Fewer IP addresses for customers to configure for both ports 80 & 443
   *Dates on the table are subject on changes.

   Host name	Current IP addresses (IPv4 and IPv6)	New IP addresses (IPv4 and IPv6)	Target date *
   esupport.ibm.com	129.42.21.70 2607:f0d0:3901:33:129:42:21:70	192.148.6.11 2620:1f7:c010:1:1:1:1:11	1 March 2024 - New IP enabled and returned from DNS. - Current IP disabled and no longer returned from DNS.
   esupport.ibm.com	129.42.56.189 2620:0:6c4:200:129:42:56:189	n/a	1 March 2024 - IP no longer returned from DNS, although access through static IP still allowed for non-DNS implementations. 30 June 2024 - Access through static IP disabled.
   esupport.ibm.com	129.42.60.189 2620:0:6c4:200:129:42:60:189	n/a	1 March 2024 - IP no longer returned from DNS, although access through static IP still allowed for non-DNS implementations. 30 June 2024 - Access through static IP disabled.
   esupport.ibm.com	n/a	170.225.123.67	Note: This IP is being enabled for "static access only" to help ease the transition from static IP access to DNS access. 1 March 2024 - Available for access through static IP only for non-DNS implementations. IP will not be returned from DNS. 1 November 2024 - Static IP access will be disabled.

   Edge replaces IP addresses needed for Service Providers, Download Servers, Upload Servers and CCF, but not FTP.

   Summary of actions required:

   Enable firewall access to IP addresses before 1 March 2024:

   • 192.148.6.11 (port 443)
   • 170.225.123.67 (port 443)
   • 2620:1f7:c010:1:1:1:1:11 (port 443)  - if IPv6 connections required

   Enable DNS or a firewall/proxy connectivity solution in place of static IP addresses before 1 November 2024.
    

   
   Note: Having PTF SI68172 on system would require ONLY port 443 to be open. Port 80 is no needed anymore.

   
   IP addresses are subject to change. Recommended, use Host Name (DNS names) whenever possible, for EDGE: esupport.ibm.com
    

2. IPv6 connectivity for both ports 80 & 443. The Edge server allows IPv6 connections from the client. Not all legacy servers support IPv6 connections.
    
3. Edge is the platform for security enhancements such as NIST 800-131a and NSA Suite B enablement.

EDGE server is enabled by default. 

1. PTFs SI64358 and SI69059 HAVE TO be on system before change anything. Otherwise, it won't work.
    
2. EDTF STMF('/qibm/proddata/os400/universalconnection/eccConnect.properties') 
   Include the following lines. Some are edits of existing lines, others might be new lines:
    
   _IBM.SP_UPDATE_INIT = NO     
   _IBM.SP_LOCATION_URL = https://esupport.ibm.com/eccedge/gateway/services/projects/ecc/serviceProviderIBMV2.gzip
   PREFER_EDGE = ALL
   DEFAULT_DATAURI_TYPE = INDIRECT
    
   Or could use the eccConnect.properties file attached and replace the one located in '/qibm/proddata/os400/universalconnection' in your system. Assure to rename the existing one before replacing it. 
   eccConnect.properties
    
3. Once file is replaced, you will need to re-create the service configuration. Follow the steps from the Configuration Instructions for Electronic Customer Support (ECS) and Electronic Service Agent (ESA) for IBM i document.

EDGE server is not supported for these releases, need to use LEGACY servers.
Review the information in the LEGACY Server IP addresses tab. 

To find the exact IBM Service Destination addresses that might be used for HTTP and HTTPS traffic, the service provider location definition files can be browsed.

The files available for this on the system are at: '/qibm/userdata/os400/universalconnection'

Notes:
1. For each option, type WRKLNK, followed by the full path. This goes directly to the noted file.
2. If using WRKLNK, taking Option 5 through the path and by using F22 on the file shows the full name.

Option 1: '/qibm/userdata/os400/universalconnection/serviceProviderIBMLocationDefinition.txt'

Note: This file is written in a more readable format than the file noted in Option 2.

A complete listing of this file is available below. In addition, a document is available for ports 80 & 443 sorted by IP address. 
When using this option, all IP addresses have to be allowed in the site firewall rules, omitting any might cause connection attempts to fail. Review LEGACY Server IP addresses tab.

Unique IPs       TCP Port
----------       --------
198.74.67.240    19285  
198.74.71.240    19285  
170.225.126.56   443  
192.109.81.20    443  
170.225.126.22   21  
129.42.160.48    443  
207.25.252.200   443  
170.225.126.43   443  
129.35.224.107   443  
170.225.126.42   443  
170.225.126.45   443  
170.225.126.46   443  
170.225.126.44   443  
170.225.126.24   443  
129.35.224.114   443  
170.225.126.39   443  
170.225.126.40   443  
170.225.126.67   443  
170.225.15.124   443  
129.35.224.124   443  
170.225.15.108   443  
129.35.224.108   443  
129.35.224.109   443  
170.225.15.109   443  
129.35.224.110   443  
170.225.15.110   443  
170.225.122.67   443  
170.225.123.67   443  
129.42.26.224    443  
129.42.50.224    443  
129.42.42.224    443  
198.74.71.235    11111  
198.74.67.235    11111  
204.146.30.17    443  80  


Unique VPN Gateways   Protocols   UDP Port
-------------------   ---------   --------
207.25.252.196        ESP, UDP    500  4500  
129.42.160.16         ESP, UDP    500  4500  

Note: When using this option, all IP addresses have to be allowed in the site firewall rules, omitting any might cause connection attempts to fail.                   

 

Test the connection by using the following commands to populate the IP addresses used for each application:

• SNDPTFORD SF98xxx
  Where xxx is the version and release of the system (for example: SF98720, SF98730, SF98740).
• SNDSRVRQS *TEST
• VFYSRVAGT TYPE(*TSTPRB)
• GO SERVICE Option 2
  Note: To check for errors when using the Go Service options, review the audit log by Go Service, Option 14; B in the position to line field.
• To test connectivity to IBM backend servers use below commands:
  - VFYSRVCFG SERVICE(*ECS) VFYOPT(*ALL) 
  Lets it complete, can take a while.
  - VFYSRVCFG SERVICE(*FIXREP) VFYOPT(*ALL)
  Lets it complete, can take a while.
  - VFYSRVCFG SERVICE(*PRBRPT) VFYOPT(*ALL)
  Lets it complete, can take a while.
  - VFYSRVCFG SERVICE(*SPCFG) VFYOPT(*ALL)
  Lets it complete, can take a while.
  - VFYSRVCFG SERVICE(*SRVAGT) VFYOPT(*ALL)
  Lets it complete, can take a while.
   
  The VFYSRVCFG commands log to joblog:  IP address, protocol, and port used along with success or failure information.
  CPIAC59: Verification was successful.
  CPIAC60: Verification was not successful.
  CPIAC61: The value does not match an existing service destination.
  
  For CPIAC60, assure Firewall is correctly set. For CPIAC61, recommended PTFs for ESA and delete and re-create service configuration, need to be followed correctly. Review Configuration Instructions for Electronic Customer Support (ECS) and Electronic Service Agent (ESA) for IBM i document.