Hot Topics - Messmer The Brain House

Figure 2 - Connectivity rules for each stack
Is it hard to learn?
No, the NSCA provides a level of
abstraction in which you work with no
more than three GUI configuration objects,
regardless of whether you are configuring
AT-TLS or CS IPSec, as follows:
• Traffic Descriptor objects identify
specific IP traffic or applications. The
tool comes with a large number of
preloaded Traffic Descriptors, such as
“TN3270_Server” and “FTP_Server.”
With a few mouse clicks, you can
extend the preloaded set and add more
customized Traffic Descriptors.
• Security Level objects identify a
specific security technology, AT-
TLS or CS IPSec, and the level of
cryptographic protection to apply.
The tool comes with a number of
preloaded Security Levels. With a
few mouse clicks, you can extend the
preloaded set to add more customized
Security Levels.
• Requirement Map objects map specific
Traffic Descriptors to specific Security
Levels. For example, within a single
Requirement Map, you can indicate
an entire set of security requirements
to govern the behavior from your z/OS
system to a branch office.
After you build these objects for your
environment, you can reuse them for many
repeating network security scenarios. For
example, that Requirement Map you built
to cover traffic between your z/OS system
to a branch office can be referenced
multiple times in your configuration—once
for each branch office to which you want
to connect.
With the creation of the Requirement
Maps, much of the heavy lifting is done.
For each TCP/IP stack, you create a series
of Connectivity Rules. See Figure 2.
Each rule identifies:
• A local host and a remote host
• Security endpoints (for IPSec only)
• A Requirement Map, which
contains the complete set of security
requirements between the two hosts.
Wizards…
The NSCA does its best to keep you on
the right track. It provides wizards to
guide you throughout the process and
ensure that you enter all of the necessary
information. Generally, each wizard asks
you a basic question and then guides you
through the remaining configuration.
Figure 3 shows an example of one such
wizard at work.
Figure 3 - Wizard screen for connectivity rules
…and a health checker, too
The wizards do their best to keep you out of
trouble, but you can still get things wrong.
So, before installing your configuration
for a specific TCP/IP stack, click on the
Health Check button. The NSCA comes
with a built-in health checker function that
examines your configuration for possible
pitfalls and provides you with feedback
on aspects of the configuration that look
suspicious or incorrect.
Let the NSCA watch your back
The NSCA is designed to dramatically
improve your time-to-value ratio. If you
choose not to use the NSCA to configure
AT-TLS or CS IPSec, that’s fine. Without
it, however, there are no wizards or health
checker; you will be the expert.
Protect your IP data; never let it go
out alone!
How do I get the NSCA?
You can download it from the z/OS
Communications Server Web site:
ibm.com/software/network/commserver/
zos/support/
February 2006 z/OS HOT TOPICS Newsletter, Issue 14 35