Firewall support

Client firewalls

This topic is only applicable to the grid version of Symphony.

You need to open up a few ports (vemkd, Session Director, session manager) in the firewall for the client to interact with the grid. The client first communicates with the vemkd and gets the port information of the Session Director. The client then connects to the Session Director and gets the port information of the session manager and then connects to the session manager. It is important to set appropriate port ranges for session managers because there may be multiple session managers in a Symphony grid.

By default, vemkd and Session Director are configured with fixed port numbers. It is required to configure the session manager ports for firewall support in the sd.xml file:

Component

Configuration file

vemkd

(Resource Manager)

Windows: %EGO_CONFDIR%\ego.conf

Linux/UNIX: $EGO_CONFDIR/ego.conf

Session Director

Windows: %EGO_CONFDIR%\..\..\eservice\esc\conf\services\sd.xml

Linux/UNIX: $EGO_CONFDIR/../../eservice/esc/conf/services/sd.xml

Session Manager

It is required to configure the Session Manager ports for firewall support:

Windows: %EGO_CONFDIR%\..\..\eservice\esc\conf\services\sd.xml

Linux/UNIX: $EGO_CONFDIR/../../eservice/esc/conf/services/sd.xml


In addition to port configuration, it may be necessary to configure TCP Keep Alive parameters for the connection endpoints in the Symphony environment. The Keep Alive messages are sent through the firewall periodically in order to prevent the firewall from dropping the connection during periods of no user-activity. For the Keep Alive feature to work under realistic conditions, it must be configured to start sending the messages before a routing device's idle time out is triggered. For example, if a firewall is configured to discard idle connections after 15 minutes, you would want your Keep Alive messages to be sent after 10 minutes of inactivity. For more information about TCP Keep Alive configuration, refer to Configuration of TCP connections

Configure

This section describes port configuration when implementing a firewall.

  1. To configure a firewall for Symphony, you have to open the ports on the firewall that are required for the connection protocols enabled on your client. Make sure you plan to open the relevant SD, vemkd, and SSM ports.
  2. Log on to the master host as the cluster administrator and shut down the Symphony grid completely.
    1. Disable all applications

      soamcontrol app disable all

    2. Stop all services

      egosh service stop all

    3. Shut down the Symphony grid

      egosh ego shutdown all

  3. Open the sd.xml file and add the port range for the SSM_SDK_ADDR and SSM_SIM_ADDR parameters. Note that you only need to define the SSM_SIM_ADDR parameter if you have a firewall between the SSMs and the SIMs.

    If there is more than one platform, then you need to add the port range for all of them.

    Example:
    <sc:ActivityDescription>
    ..............................
    <ego:EnvironmentVariable name="SD_ADMIN_PORT">@ADMIN_PORT@</ego:EnvironmentVariable><ego:EnvironmentVariable name="SD_SDK_PORT">@SDK_PORT@</ego:EnvironmentVariable>
     <ego:EnvironmentVariable name="SSM_SDK_ADDR">31000-32000</ego:EnvironmentVariable>
     <ego:EnvironmentVariable name="SSM_SIM_ADDR">32001-33000</ego:EnvironmentVariable>
    ................................
    </sc:ActivityDescription>
    Note:

    .You should ensure that the port range is sufficient for the number of SSMs that you expect to run on the same host.

    Note:

    Port range should be equal to or greater than the maximum number of slots in the management host.

  4. Start up the Symphony grid.

    egosh ego start all

    Enable all the disabled applications.

Management and compute host firewalls

Scope


Applicability

Details

Operating system (management hosts)

Windows 2003 and 2008, Linux


Feature details

Symphony offers firewall support to prevent the connection between vemkd on the management host and PEM on the compute hosts from being disconnected by a firewall when the connection remains idle for long periods of time. The same firewall support is also available for the connection between the SSM on the management host and the SIMs on the compute hosts. Firewall support is enabled by configuring the EGO_ENABLE_CHAN_KEEPALIVE parameter.

The feature works by periodically passing TCP Keep-Alive Messages between the management hosts and compute hosts. The interval timing for sending the TCP keep-alive packet while the connection between the management hosts and compute hosts is idle is configurable using the EGO_CHAN_KEEPALIVE_TIME (for connection between vemkd and PEM) and PLATCOMMDRV_TCP_KEEPALIVE_TIME (for connection between SSM and SIM).

Configuration

  1. Enable the Symphony ports in the firewall.
  2. Enable firewall support between management hosts and compute hosts by configurng EGO_ENABLE_CHAN_KEEPALIVE=y in ego.conf. By default, firewall support is disabled.
  3. Configure the TCP Keep Alive time for the connection between vemkd and PEM by setting the EGO_CHAN_KEEPALIVE_TIME parameter in ego.conf. The setting should be less than the firewall’s configured timeout for terminating a connection.The minimum valid value is 180 seconds.
  4. Configure the TCP Keep Alive time for the connection between SSM and SIM by setting the PLATCOMMDRV_TCP_KEEPALIVE_TIME environment variable in the SSM section of the application profile. For example:
    <env name=" PLATCOMMDRV_TCP_KEEPALIVE_TIME ">3600</env>
    The setting should be less than the firewall’s configured timeout for terminating a connection.