The following considerations apply to stack sysplex features in
a multilevel secure environment:
- If TCPSTACKSOURCEVIPA is configured on a stack, the specified
VIPA must be in a NetAccess security zone with a security label that
is identical to the stack security label.
- If you use job-specific source IP addressing (see SRCIP in z/OS Communications Server: IP Configuration
Reference), the specified IP address must be in a NetAccess
security zone with a security label that is permitted on the stack
and is equivalent to the specified job. If an interface name is used,
at least one of the IP addresses configured on that interface must
be in a network security zone with a security label that is either
SYSMULTI or equal to the specified job.
- If you use destination-specific source IP addressing (see SRCIP in z/OS Communications Server: IP Configuration
Reference), the specified IP address must be in a NetAccess
security zone with a security label that is permitted on the stack
and is equivalent to the specified destination. If an interface name
is used, at least one of the IP addresses configured on that interface
must be in a network security zone with a security label that is either
SYSMULTI or that is the same as the specified destination.
- For sysplex distributor, the distributing stack must either be
an unrestricted stack or a restricted stack with a security label
that is the same as all target stacks. The distributing stack will
use the security label of the source security zone and the security
labels of the active target applications when selecting a target.
The distributing stack will also honor SECLBYSYSTEM when the target
application is running under SYSMULTI on an unrestricted stack. In
an environment using SECLBYSYSTEM, a distributing stack must be on
a system where all security labels are active.
- VIPA takeover must be configured only between stacks with the
same security label.
- Distribution of connections that require packet tagging are restricted
to flowing over XCF or IUTSAMEHOST links. This restriction applies
to the route from the client to the distributor, from the distributor
to the target server, and from the target server back to the client.