IP Services: Understand the change in the support provided by the DVIPSEC parameter on the IPSEC statement in the TCP/IP profile

Description: Before z/OS V2R1, the DVIPSEC parameter on the IPSEC statement in the TCP/IP profile enabled Sysplex-Wide Security Associations (SWSA) for IPv4 on a stack that had IPCONFIG IPSECURITY specified in the TCP/IP profile. Support for SWSA for IPv6 was not provided in these releases.

Beginning with z/OS V2R1, SWSA for IPv6 is supported. The DVIPSEC parameter on the IPSEC statement in the TCP/IP profile enables SWSA for IPv6 on a stack that has IPCONFIG6 IPSECURITY specified in the TCP/IP profile.

Element or feature:

Communications Server.

When change was introduced:

z/OS V2R1.

Applies to migration from:

z/OS V1R13 and z/OS V1R12.

Timing:

Before installing z/OS V2R1.

Is the migration action required?

Yes, if the TCP/IP profile for your stack specifies the IPSECURITY parameter on the IPCONFIG6 statement and also specifies the DVIPSEC parameter on the IPSEC statement.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take: Follow these steps:

If you have both of the following specified in your TCP/IP profile, be aware that SWSA for IPv6 will be enabled on your stack:
- The IPSECURITY parameter on the IPCONFIG6 statement
- The DVIPSEC parameter on the IPSEC statement
If you have IPv6 TCP traffic that is protected by an IPSec Security Association (SA) with an IPv6 DVIPA endpoint, you can see the following changes:
- When an IPv6 DVIPA is moved during a planned or unplanned DVIPA takeover, new SAs are automatically reestablished with the same security service characteristics as the SAs that existed on the host that owned the DVIPA.
- IPv6 TCP traffic that is protected by an IPSec SA with a sysplex-distributed DVIPA endpoint can be distributed to target hosts.
Ensure that you configure the appropriate IP security policy on the backup and target hosts.

Reference information: See "Sysplex-Wide Security Associations" in z/OS V2R1.0 Communications Server: IP Configuration Guide.