Setting for work across firewalls

Prior to IBM Z Workload Scheduler version 8.2, running the commands to start or stop a workstation or to get the standard list, required opening a direct TCP/IP connection between the originator and the destination nodes. In a firewall environment, this forces users to break the firewall to open a direct communication path between the master and each fault-tolerant agent in the network.

The FIREWALL configurable attribute of the CPUREC statement can be configured to send commands following the domain hierarchy, instead of making the master or the domain manager open a direct connection.

In the design phase of an IBM Workload Scheduler network, the administrator must know where the firewalls are positioned in the network, which fault-tolerant agents and which domain managers belong to a particular firewall, and what are the entry points into the firewalls. When this has been clearly understood, the administrator should define the FIREWALL option for all workstations whose link with the corresponding domain manager is across a firewall. This keyword corresponds to behind firewall in the workstation's definition in the IBM Workload Scheduler database.

When the FIREWALL option is set to YES for a workstation by using the CPUREC statement, it means that a firewall exists between that particular workstation and its domain manager, and that the link between the domain manager and the workstation (which can itself be another domain manager) is the only allowed link between the respective domains. Also, for all the workstations having this option set to YES, the commands to start (start wkstation) or stop (stop wkstation) the workstation or to get the standard list (showjobs) and the download of centralized scripts, follow the domain hierarchy instead of opening a direct connection between the master (or domain manager) and the workstation. This makes a significant improvement in security and performance. The default value for FIREWALL is NO, meaning that there is no firewall boundary between the workstation and its domain manager.

To specify that an extended agent is behind a firewall, set the FIREWALL keyword for the host workstation. The host workstation is the IBM Workload Scheduler workstation with which the extended agent communicates and where its access method resides.