WSC Experiences with IPSec on the ziip Processor

Transcription

1 WSC Experiences with IPSec on the ziip Processor v Walt Caprice IBM Washington Systems Center Gaithersburg, MD

2 Trademarks AIX* CICS* DB2* DB2 Connect DB2 Universal Database DRDA* FICON* GDPS* HiperSockets IBM* IBM eserver IBM logo* IMS On Demand Business logo Parallel Sysplex* System z System z9 WebSphere* z/architecture z/os* z/vm* zseries* * Registered trademarks of IBM Corporation The following are trademarks or registered trademarks of other companies. Intel is a trademark of the Intel Corporation in the United States and other countries. Linux is a registered trademark of Linus Torvalds in the United States, other countries, or both. Java and all Java-related trademarks and logos are trademarks or registered trademarks of Sun Microsystems, Inc., in the United States and other countries. Microsoft, Windows and Windows NT are registered trademarks of Microsoft Corporation. UNIX is a registered trademark of The Open Group in the United States and other countries. * All other products may be trademarks or registered trademarks of their respective companies. Notes: Performance is in Internal Throughput Rate (ITR) ratio based on measurements and projections using standard IBM benchmarks in a controlled environment. The actual throughput that any user will experience will vary depending upon considerations such as the amount of multiprogramming in the user's job stream, the I/O configuration, the storage configuration, and the workload processed. Therefore, no assurance can be given that an individual user will achieve throughput improvements equivalent to the performance ratios stated here. IBM hardware products are manufactured from new parts, or new and serviceable used parts. Regardless, our warranty terms apply. All customer examples cited or described in this presentation are presented as illustrations of the manner in which some customers have used IBM products and the results they may have achieved. Actual environmental costs and performance characteristics will vary depending on individual customer configurations and conditions. This publication was produced in the United States. IBM may not offer the products, services or features discussed in this document in other countries, and the information may be subject to change without notice. Consult your local IBM business contact for information on the product or services available in your area. All statements regarding IBM's future direction and intent are subject to change or withdrawal without notice, and represent goals and objectives only. Information about non-ibm products is obtained from the manufacturers of those products or their published announcements. IBM has not tested those products and cannot confirm the performance, compatibility, or any other claims related to non-ibm products. Questions on the capabilities of non-ibm products should be addressed to the suppliers of those products. Prices subject to change without notice. Contact your IBM representative or Business Partner for the most current pricing in your geography. This presentation and the claims outlined in it were reviewed for compliance with US law. Adaptations of these claims for use in other geographies must be reviewed by the local country counsel for compliance with local laws. 2

3 Disclaimer IBM Washington Systems Center The information in this document has not been submitted to any formal IBM test and is distributed on an "as is" basis without any warranty expressed or implied. Use of this information or the implementation of any of these techniques is a user responsibility and depends on the user's ability to evaluate and integrate them into the user's operational environment. While each item may have been reviewed for accuracy in a specific situation there is no guarantee the same or similar results may be achieved elsewhere. Users attempting to adapt these techniques to their environments do so at their own risk. 3

4 Agenda A specialty engine update What is IPSec RMF updated Workload Activity Report Available estimation techniques Measurements Configuration Run objectives Results Summary Questions 4

5 Mainframe Innovation: Specialty Engines Integrated Facility for Linux (IFL) 2000 System z Application Assist Processor (zaap) 2004 Eligible for zaap: Java execution environment IBM System z9 Integrated Information Processor (IBM ziip) 2006 Eligible for ziip: DB2 remote access and BI/DW ISVs New! IPSec encryption (2007) Internal Coupling Facility (ICF)

6 Attractive pricing for new workloads Helping Driving down the cost of IT Specialty engines addressing more new workloads: NEW: IPSec Linux, Java, Data-serving Integrated Facility for Linux (IFL) Specialty engines designed to offer financial benefits now and in the future: Technology investment protection Lowering the cost of future growth with extra capacity at no extra cost System z Application Assist Processor (zaap) IBM System z9 Integrated Information Processor (IBM ziip) 6

7 IPSec IBM Washington Systems Center What is IPSec? IPSec (IP Security) is a suite of protocols for securing Internet Protocol (IP) communications by authenticating and/or encrypting each IP packet in a data stream. IPSec also includes protocols for cryptographic key establishment. IPSec helps enable secure tunnels between two IP entities Virtual Private Network Helps provide end-to-end network encryption Why is it important? Some encryption technologies are application-specific SSL, Open SSH, AT-TLS IPSec is designed to encrypt specific applications IPSec can encrypt all traffic over an IP connection Encrypted packet 7

8 IPSec provides end-to-end network encryption An option for protecting sensitive data on the mainframe End-to-end network encryption is becoming more pervasive due to regulatory and enterprise security policies End-to-end network encryption is also becoming a requirement for companies that outsource some part of their network and want to have greater control of access to confidential data z/os Unencrypted Network Device IPSec Network Device Unencrypted Server, (z/os, UNIX, Linux, etc.) ATM, POS, Printer, Laptop, Network device Encryption in network devices z/os IPSec Network Device Network Device IPSec Server, (z/os, UNIX, Linux, etc.) ATM, POS, Printer, Laptop, Network device 8 End-to-end encryption Any platform supporting the IPSec standard protocol either natively or with additional software

9 ziip Assisted IPSec IBM is enhancing z/os Communications Server to allow the IPSec processing to take advantage of ziips This ziip Assisted IPSec function moves most z/os IPSec processing from general purpose processors to ziips Performs the encryption processing Handles cryptographic validation of message integrity, and IPSec header processing. z/os Communication Server (z/os CS) is designed to interact with z/os Workload Manager to have all of its enclave Service Request Block (SRB) work made eligible to run on the ziip Planned availability z/os 1.8 plus PTFs in August 2007 z/os 1.9 at GA 9

10 Why IPSec on the ziip? The ziip is designed to help: Integrate data and data transaction processing across the enterprise Improve resource optimization and lower the cost of ownership for eligible data serving and transaction processing workloads IBM will not impose IBM software charges on the ziip Attractively price, much lower than general purpose CP IPSec is designed to help Secure data and data transaction processing across the enterprise IPSec on a ziip positions IBM System z9 as a costeffective server in environments requiring end-to-end security for IP network traffic. 10

11 What IPSec workload is eligible for ziip? The ziip Assisted IPSec function is designed to move most of the IPSec processing from the general purpose processors to the ziips. z/os CS TCP/IP recognizes IPSec packets and routes a portion of them to an independent enclave SRB this workload is eligible for the ziip Inbound operation (not initiated by z/os) All inbound IPSec processing is dispatched to enclave Client z/os SRBs and is eligible for ziip IPSec All subsequent outbound IPSec responses from z/os are dispatched to enclave SRB All encryption/decryption processing, cryptographic validation of message integrity, and IPSec header processing sent to ziip Outbound operation (initiated by z/os) Operation which starts out on TCBs is not ziip eligible Any inbound response/acknowledgement is SRB based and is ziip eligible All subsequent outbound IPSec responses from z/os are ziip eligible Print Print Print z/os z/os z/os ziip ziip ziip ziip Client z/os ziip IPSec 11

12 Example 1- Estimated impact of ziip assisted IPSec on inbound bulk data transfer workload** FTP with no IPSec FTP with IPSec and no ziip FTP with IPSec and ziip Example: Inbound FTP System z9 workload TCP/IP Decrypt Encrypt Encryption with ziip can make IPSec on z/os more cost effective Decrypt Encrypt (enclave SRBs only) TCP/IP TCP/IP TCP/IP CPs No Decryption CPs CPs ziips Triple-DES and SHA authentication Triple-DES and SHA authentication ** Under IBM lab test conditions, this example shows capacity required for TCP/IP for the FTP portion only. For illustrative purposes only, your results may vary. Applying IPSec encryption/ decryption may lower overall I/O throughput for bulk data transfers regardless if executed on CP or ziip 12

13 Example 2- Estimated impact of ziip assisted IPSec on outbound bulk data transfer workload** FTP with no IPSec FTP with IPSec and no ziip FTP with IPSec and ziip Example: Outbound FTP System z9 workload TCP/IP TCP/IP Encrypt Decrypt TCP/IP Encrypt Decrypt TCP/IP Encrypt Decrypt (enclave SRBs only) CPs CPs CPs ziips No Decryption Triple-DES and SHA authentication Triple-DES and SHA authentication ** Under IBM lab test conditions, this example shows capacity required for TCP/IP for the FTP portion only. For illustrative purposes only, your results may vary. Applying IPSec encryption/ decryption may lower overall I/O throughput for bulk data transfers regardless if executed on CP or ziip 13

14 Example 3- Estimated impact of ziip assisted IPSec on interactive workload** Interactive with no IPSec Interactive with IPSec and no ziip Interactive with IPSec and ziip Interactive System z9 workload TCP/IP Encrypt Decrypt Encrypt Decrypt TCP/IP CPs No Decryption TCP/IP Triple-DES and SHA authentication TCP/IP Encrypt Decrypt (enclave SRBs only) CPs CPs ziips Triple-DES and SHA authentication ** Under IBM lab test conditions, this example shows capacity required for TCP/IP for the interactive portion only. For illustrative purposes only, your results may vary. 14

15 How is IPSec enabled for ziip? The z/os Communication Server (z/os CS) interacts with z/os Workload Manager to have all of it s enclave Service Request Block (SRB) work eligible for a ziip A single configuration statement within the TCP/IP profile triggers z/os CS to request z/os to direct this IPSec Enclave SRB processing to an available ziip GLOBALCONFIG ZIIP IPSECURITY (= eligible work is directed to ziip) GLOBALCONFIG ZIIP NOIPSECURITY (default) Independent enclave allows the work to be classified to a unique service class to influence IPSec access to ziips and general purpose CPs New WLM subsystem type TCP Enclave exists for the life of the TCP/IP stack, therefore use: Single period Velocity performance objective 15

16 Updated RMF Workload Activity Report REPORT BY: POLICY=WLMPOL WORKLOAD=ONL_WKL SERVICE CLASS=IPSEC RESOURCE GROUP=*NONE CRITICAL =NONE TRANSACTIONS TRANS-TIME HHH.MM.SS.TTT --DASD I/O-- ---SERVICE---- SERVICE TIMES ---APPL %--- AVG 1.00 ACTUAL 0 SSCHRT 0.0 IOC 0 CPU 66.9 CP MPL 1.00 EXECUTION 0 RESP 0.0 CPU 1796K SRB 0.0 AAPCP 0.00 ENDED 0 QUEUED 0 CONN 0.0 MSO 0 RCT 0.0 IIPCP END/S 0.00 R/S AFFIN 0 DISC 0.0 SRB 0 IIT 0.0 #SWAPS 0 INELIGIBLE 0 Q+PEND 0.0 TOT 1796K HST 0.0 AAP 0.00 EXCTD 0 CONVERSION 0 IOSQ 0.0 /SEC 2994 AAP 0.0 IIP 0.00 AVG ENC 1.00 STD DEV 0 IIP 0.0 REM ENC 0.00 ABSRPTN 2994 MS ENC 0.00 TRX SERV 2994 GOAL: EXECUTION VELOCITY 40.0% VELOCITY MIGRATION: I/O MGMT 19.8% INIT MGMT 19.8% RESPONSE TIME EX PERF AVG USING% EXECUTION DELAYS % SYSTEM VEL% INDX ADRSP CPU AAP IIP I/O TOT CPU SYSD --N/A IPSec Independent Enclave Total ziip seconds subset of CPU seconds IPSec Enclave will not have a transaction count Total normalized CPU seconds % utilization of ziip % utilization of general purpose CP eligible to run on a ziip 16 % utilization of general purpose CP

17 IPSec Estimation Techniques Whitepaper on Techdocs describes all three techniques WP Capacity Planning for ziip-assisted IPSec 1. Use of PROJECTCPU parameter in IEAOPTxx member of SYS1.PARMLIB Requires: Software levels needed to support IPSec Currently running IPSec Most people will not meet the requirements 2. Use SRB time reported for the TCP/IP address space IPSec currently being used Most TCP/IP traffic using IPSec Most people will not meet the requirements 17

18 IPSec Estimation Techniques Whitepaper on Techdocs describes all three techniques WP Capacity Planning for ziip-assisted IPSec 3. IPSec Modeling Available for any supported release of TCP/IP Does not require IPSec to be currently implemented Supplied program will capture required TCP/IP variables Simple questionnaire contains future expectations Model run by IBM Techline organization Most people will use this technique Contact your account team for more information 18

19 Measurements 19

20 Configuration IBM Washington Systems Center z/os 1.8 partition on z990 Running 1 FTP job PUT a single file 2466 CYLS z/os 1.8 partition on z9 4 GCPs 2 ziips DRDA-Like Work UNIX address space supporting FTP request from client Intranet WLM specifications: DRDA Velocity 50 Importance 2 IPSec Velocity 40 Importance 3 20

21 Measurement Objectives Validate IPSec runs as advertised 1. Model impact of IPSec using new IBM tools IPSec not currently enabled Use IBM supplied tool to capture TCP/IP modeling variables New function in zcp3000 set expectation for IPSec enablement with ziips 2. Use PROJECTCPU set expectation for IPSec enablement with ziips IPSec must be enabled for this step Compare results of zcp3000 model and PROJECTCPU values 3. Enable IPSec Validate accuracy of zcp3000 and PROJECTCPU projections Review impact of ziip capacity shortages and z/os Needs Help dispatcher Demonstrate competing ziip eligible workloads 21

22 Measurements with IPSec Off Run (1) C P U A C T I V I T Y z/os V1R8 SYSTEM ID SYSD START 04/26/2007- RPT VERSION V1R8 RMF END 04/26/2007- CPU 2094 MODEL 744 H/W MODEL S54 ---CPU--- ONLINE TIME LPAR BUSY MVS BUSY CPU SERIAL I/O TOTAL NUM TYPE PERCENTAGE TIME PERC TIME PERC NUMBER INTERRUPT RATE 0 CP B10E CP B10E CP B10E CP B10E CP TOTAL/AVERAGE

23 Measurements with IPSec Off Run (1) REPORT BY: POLICY=WLMPOL WORKLOAD=DB_WKL SERVICE CLASS=DDFDEF RESOURCE GROUP=*NONE CRITICAL =NONE TRANSACTIONS TRANS-TIME HHH.MM.SS.TTT --DASD I/O-- ---SERVICE---- SERVICE TIMES ---APPL %--- AVG 3.00 ACTUAL 0 SSCHRT 0.0 IOC 0 CPU CP MPL 3.00 EXECUTION 0 RESP 0.0 CPU 31602K SRB 0.0 AAPCP 0.00 ENDED 0 QUEUED 0 CONN 0.0 MSO 0 RCT 0.0 IIPCP END/S 0.00 R/S AFFIN 0 DISC 0.0 SRB 0 IIT 0.0 #SWAPS 0 INELIGIBLE 0 Q+PEND 0.0 TOT 31602K HST 0.0 AAP 0.00 EXCTD 0 CONVERSION 0 IOSQ 0.0 /SEC AAP 0.0 IIP 0.00 AVG ENC 3.00 STD DEV 0 IIP 0.0 REM ENC 0.00 ABSRPTN 18K MS ENC 0.00 TRX SERV 18K GOAL: EXECUTION VELOCITY 50.0% VELOCITY MIGRATION: I/O MGMT 38.9% INIT MGMT 38.9% RESPONSE TIME EX PERF AVG USING% EXECUTION DELAYS % SYSTEM VEL% INDX ADRSP CPU AAP IIP I/O TOT CPU SYSD --N/A A transaction consumes 20 msec of CPU time Transaction Rate = msec per sec * 20 msec per tran = 98 transactions/sec Transactions delayed due to CPU delay 23

24 Measurements with IPSec Off Run (1) REPORT BY: POLICY=WLMPOL REPORT CLASS=RTCPIP DESCRIPTION =Report Class for TCPIP TRANSACTIONS TRANS-TIME HHH.MM.SS.TTT --DASD I/O-- ---SERVICE---- SERVICE TIMES ---APPL %--- AVG 1.00 ACTUAL 0 SSCHRT 0.0 IOC 92 CPU 0.2 CP 2.56 MPL 1.00 EXECUTION 0 RESP 0.8 CPU 6346 SRB 15.1 AAPCP 0.00 ENDED 0 QUEUED 0 CONN 0.8 MSO 0 RCT 0.0 IIPCP 0.00 END/S 0.00 R/S AFFIN 0 DISC 0.0 SRB IIT 0.0 #SWAPS 0 INELIGIBLE 0 Q+PEND 0.0 TOT HST 0.0 AAP 0.00 EXCTD 0 CONVERSION 0 IOSQ 0.0 /SEC 687 AAP 0.0 IIP 0.00 AVG ENC 0.00 STD DEV 0 IIP 0.0 REM ENC 0.00 ABSRPTN 687 MS ENC 0.00 TRX SERV 687 REPORT BY: POLICY=WLMPOL WORKLOAD=OMVS_WKL SERVICE CLASS=UNIX RESOURCE GROUP=*NONE CRITICAL =NONE TRANSACTIONS TRANS-TIME HHH.MM.SS.TTT --DASD I/O-- ---SERVICE---- SERVICE TIMES ---APPL %--- AVG 1.55 ACTUAL SSCHRT 84.1 IOC CPU 7.2 CP 1.46 MPL 1.55 EXECUTION RESP 10.0 CPU SRB 1.4 AAPCP 0.00 ENDED 3 QUEUED 0 CONN 9.5 MSO 0 RCT 0.0 IIPCP 0.00 END/S 0.01 R/S AFFIN 0 DISC 0.4 SRB IIT 0.2 #SWAPS 120 INELIGIBLE 0 Q+PEND 0.1 TOT HST 0.0 AAP 0.00 EXCTD 0 CONVERSION 0 IOSQ 0.0 /SEC 509 AAP 0.0 IIP 0.00 AVG ENC 0.00 STD DEV 0 IIP 0.0 REM ENC 0.00 ABSRPTN 328 MS ENC 0.00 TRX SERV 328 GOAL: EXECUTION VELOCITY 10.0% VELOCITY MIGRATION: I/O MGMT 98.2% INIT MGMT 98.2% RESPONSE TIME EX PERF AVG USING% EXECUTION DELAYS % SYSTEM VEL% INDX ADRSP CPU AAP IIP I/O TOT I/O CPU SYSD --N/A

25 Measurements with IPSec Off Run (1) REPORT BY: POLICY=WLMPOL WORKLOAD=ONL_WKL SERVICE CLASS=IPSEC RESOURCE GROUP=*NONE CRITICAL =NONE TRANSACTIONS TRANS-TIME HHH.MM.SS.TTT --DASD I/O-- ---SERVICE---- SERVICE TIMES ---APPL %--- AVG 1.00 ACTUAL 0 SSCHRT 0.0 IOC 0 CPU 0.0 CP 0.00 MPL 1.00 EXECUTION 0 RESP 0.0 CPU 0 SRB 0.0 AAPCP 0.00 ENDED 0 QUEUED 0 CONN 0.0 MSO 0 RCT 0.0 IIPCP 0.00 END/S 0.00 R/S AFFIN 0 DISC 0.0 SRB 0 IIT 0.0 #SWAPS 0 INELIGIBLE 0 Q+PEND 0.0 TOT 0 HST 0.0 AAP 0.00 EXCTD 0 CONVERSION 0 IOSQ 0.0 /SEC 0 AAP 0.0 IIP 0.00 AVG ENC 1.00 STD DEV 0 IIP 0.0 REM ENC 0.00 ABSRPTN 0 MS ENC 0.00 TRX SERV 0 GOAL: EXECUTION VELOCITY 40.0% VELOCITY MIGRATION: I/O MGMT 0.0% INIT MGMT 0.0% RESPONSE TIME EX PERF AVG USING% EXECUTION DELAYS % SYSTEM VEL% INDX ADRSP CPU AAP IIP I/O TOT SYSD --N/A IPSec has been turned on inside TCPIP stack so enclave is created Current workload is NOT using IPSec This is the service class which will contain IPSec cycles if the enclave is not classified it will default to SYSOTHER 25

26 zcp3000 Modeled Result 26

27 Measurements with IPSec On No ziips Run (2) z/os V1R8 SYSTEM ID SYSD START 04/26/2007- RPT VERSION V1R8 RMF END 04/26/2007- CPU 2094 MODEL 744 H/W MODEL S54 ---CPU--- ONLINE TIME LPAR BUSY MVS BUSY CPU SERIAL I/O TOTAL NUM TYPE PERCENTAGE TIME PERC TIME PERC NUMBER INTERRUPT RATE 0 CP B10E CP B10E CP B10E CP B10E CP TOTAL/AVERAGE

28 Measurements with IPSec On No ziips Run (2) REPORT BY: POLICY=WLMPOL WORKLOAD=DB_WKL SERVICE CLASS=DDFDEF RESOURCE GROUP=*NONE CRITICAL =NONE TRANSACTIONS TRANS-TIME HHH.MM.SS.TTT --DASD I/O-- ---SERVICE---- SERVICE TIMES ---APPL %--- AVG 3.00 ACTUAL 0 SSCHRT 0.0 IOC 0 CPU CP MPL 3.00 EXECUTION 0 RESP 0.0 CPU 35557K SRB 0.0 AAPCP 0.00 ENDED 0 QUEUED 0 CONN 0.0 MSO 0 RCT 0.0 IIPCP END/S 0.00 R/S AFFIN 0 DISC 0.0 SRB 0 IIT 0.0 #SWAPS 0 INELIGIBLE 0 Q+PEND 0.0 TOT 35557K HST 0.0 AAP 0.00 EXCTD 0 CONVERSION 0 IOSQ 0.0 /SEC AAP 0.0 IIP 0.00 AVG ENC 3.00 STD DEV 0 IIP 0.0 REM ENC 0.00 ABSRPTN 20K MS ENC 0.00 TRX SERV 20K GOAL: EXECUTION VELOCITY 50.0% VELOCITY MIGRATION: I/O MGMT 47.6% INIT MGMT 47.6% RESPONSE TIME EX PERF AVG USING% EXECUTION DELAYS % SYSTEM VEL% INDX ADRSP CPU AAP IIP I/O TOT CPU SYSD --N/A A transaction consumes 20 msec of CPU time Transaction Rate = msec per sec/20 msec per tran = 110 transactions/sec Transactions delayed due to CPU delay 28

29 Measurements with IPSec On No ziips Run (2) REPORT BY: POLICY=WLMPOL REPORT CLASS=RTCPIP DESCRIPTION =Report Class for TCPIP TRANSACTIONS TRANS-TIME HHH.MM.SS.TTT --DASD I/O-- ---SERVICE---- SERVICE TIMES ---APPL %--- AVG 1.00 ACTUAL 0 SSCHRT 0.0 IOC 0 CPU 0.2 CP 0.57 MPL 1.00 EXECUTION 0 RESP 0.0 CPU 4128 SRB 3.3 AAPCP 0.00 ENDED 0 QUEUED 0 CONN 0.0 MSO 0 RCT 0.0 IIPCP 0.00 END/S 0.00 R/S AFFIN 0 DISC 0.0 SRB IIT 0.0 #SWAPS 0 INELIGIBLE 0 Q+PEND 0.0 TOT HST 0.0 AAP 0.00 EXCTD 0 CONVERSION 0 IOSQ 0.0 /SEC 153 AAP 0.0 IIP 0.00 AVG ENC 0.00 STD DEV 0 IIP 0.0 REM ENC 0.00 ABSRPTN 153 MS ENC 0.00 TRX SERV 153 REPORT BY: POLICY=WLMPOL WORKLOAD=OMVS_WKL SERVICE CLASS=UNIX RESOURCE GROUP=*NONE CRITICAL =NONE TRANSACTIONS TRANS-TIME HHH.MM.SS.TTT --DASD I/O-- ---SERVICE---- SERVICE TIMES ---APPL %--- AVG 1.66 ACTUAL SSCHRT 41.0 IOC CPU 3.9 CP 0.78 MPL 1.61 EXECUTION RESP 10.0 CPU SRB 0.7 AAPCP 0.00 ENDED 1 QUEUED 0 CONN 9.5 MSO 0 RCT 0.0 IIPCP 0.00 END/S 0.00 R/S AFFIN 0 DISC 0.4 SRB IIT 0.1 #SWAPS 116 INELIGIBLE 0 Q+PEND 0.1 TOT HST 0.0 AAP 0.00 EXCTD 0 CONVERSION 0 IOSQ 0.0 /SEC 266 AAP 0.0 IIP 0.00 AVG ENC 0.00 STD DEV 0 IIP 0.0 REM ENC 0.00 ABSRPTN 165 MS ENC 0.00 TRX SERV 160 GOAL: EXECUTION VELOCITY 10.0% VELOCITY MIGRATION: I/O MGMT 40.2% INIT MGMT 40.2% RESPONSE TIME EX PERF AVG USING% EXECUTION DELAYS % SYSTEM VEL% INDX ADRSP CPU AAP IIP I/O TOT CPU I/O SYSD --N/A

30 Measurements with IPSec On No ziips Run (2) REPORT BY: POLICY=WLMPOL WORKLOAD=ONL_WKL SERVICE CLASS=IPSEC RESOURCE GROUP=*NONE CRITICAL =NONE TRANSACTIONS TRANS-TIME HHH.MM.SS.TTT --DASD I/O-- ---SERVICE---- SERVICE TIMES ---APPL %--- AVG 1.00 ACTUAL 0 SSCHRT 0.0 IOC 0 CPU 66.9 CP MPL 1.00 EXECUTION 0 RESP 0.0 CPU 1796K SRB 0.0 AAPCP 0.00 ENDED 0 QUEUED 0 CONN 0.0 MSO 0 RCT 0.0 IIPCP END/S 0.00 R/S AFFIN 0 DISC 0.0 SRB 0 IIT 0.0 #SWAPS 0 INELIGIBLE 0 Q+PEND 0.0 TOT 1796K HST 0.0 AAP 0.00 EXCTD 0 CONVERSION 0 IOSQ 0.0 /SEC 2994 AAP 0.0 IIP 0.00 AVG ENC 1.00 STD DEV 0 IIP 0.0 REM ENC 0.00 ABSRPTN 2994 MS ENC 0.00 TRX SERV 2994 GOAL: EXECUTION VELOCITY 40.0% VELOCITY MIGRATION: I/O MGMT 19.8% INIT MGMT 19.8% RESPONSE TIME EX PERF AVG USING% EXECUTION DELAYS % SYSTEM VEL% INDX ADRSP CPU AAP IIP I/O TOT CPU SYSD --N/A PROJECTCPU Value IPSec has been turned on inside TCPIP stack so enclave is created Current workload IS using IPSec This is the service class which will contain IPSec cycles zcp3000 projected a value of 15% 30

31 Measurements with IPSec On One ziip Run (3) z/os V1R8 SYSTEM ID SYSD START 04/26/2007- RPT VERSION V1R8 RMF END 04/26/2007- CPU 2094 MODEL 744 H/W MODEL S54 ---CPU--- ONLINE TIME LPAR BUSY MVS BUSY CPU SERIAL I/O TOTAL NUM TYPE PERCENTAGE TIME PERC TIME PERC NUMBER INTERRUPT RATE 0 CP B10E CP B10E CP B10E CP B10E CP TOTAL/AVERAGE IIP B10E IIP AVERAGE

32 Measurements with IPSec On One ziip Run (3) REPORT BY: POLICY=WLMPOL WORKLOAD=DB_WKL SERVICE CLASS=DDFDEF RESOURCE GROUP=*NONE CRITICAL =NONE TRANSACTIONS TRANS-TIME HHH.MM.SS.TTT --DASD I/O-- ---SERVICE---- SERVICE TIMES ---APPL %--- AVG 3.00 ACTUAL 0 SSCHRT 0.0 IOC 0 CPU CP MPL 3.00 EXECUTION 0 RESP 0.0 CPU 44399K SRB 0.0 AAPCP 0.00 ENDED 0 QUEUED 0 CONN 0.0 MSO 0 RCT 0.0 IIPCP END/S 0.00 R/S AFFIN 0 DISC 0.0 SRB 0 IIT 0.0 #SWAPS 0 INELIGIBLE 0 Q+PEND 0.0 TOT 44399K HST 0.0 AAP 0.00 EXCTD 0 CONVERSION 0 IOSQ 0.0 /SEC AAP 0.0 IIP AVG ENC 3.00 STD DEV 0 IIP REM ENC 0.00 ABSRPTN 25K MS ENC 0.00 TRX SERV 25K GOAL: EXECUTION VELOCITY 50.0% VELOCITY MIGRATION: I/O MGMT 60.4% INIT MGMT 60.4% RESPONSE TIME EX PERF AVG USING% EXECUTION DELAYS % SYSTEM VEL% INDX ADRSP CPU AAP IIP I/O TOT CPU IIP SYSD --N/A A transaction consumes 20 msec of CPU time Transaction Rate = msec per sec/20 msec per tran = 138 transactions/sec Transactions delayed due to CPU delay 32

33 Measurements with IPSec On One ziip Run (3) REPORT BY: POLICY=WLMPOL REPORT CLASS=RTCPIP DESCRIPTION =Report Class for TCPIP TRANSACTIONS TRANS-TIME HHH.MM.SS.TTT --DASD I/O-- ---SERVICE---- SERVICE TIMES ---APPL %--- AVG 1.00 ACTUAL 0 SSCHRT 0.0 IOC 0 CPU 0.2 CP 1.35 MPL 1.00 EXECUTION 0 RESP 0.0 CPU 4199 SRB 7.9 AAPCP 0.00 ENDED 0 QUEUED 0 CONN 0.0 MSO 0 RCT 0.0 IIPCP 0.00 END/S 0.00 R/S AFFIN 0 DISC 0.0 SRB IIT 0.0 #SWAPS 0 INELIGIBLE 0 Q+PEND 0.0 TOT HST 0.0 AAP 0.00 EXCTD 0 CONVERSION 0 IOSQ 0.0 /SEC 362 AAP 0.0 IIP 0.00 AVG ENC 0.00 STD DEV 0 IIP 0.0 REM ENC 0.00 ABSRPTN 362 MS ENC 0.00 TRX SERV 362 REPORT BY: POLICY=WLMPOL WORKLOAD=OMVS_WKL SERVICE CLASS=UNIX RESOURCE GROUP=*NONE CRITICAL =NONE TRANSACTIONS TRANS-TIME HHH.MM.SS.TTT --DASD I/O-- ---SERVICE---- SERVICE TIMES ---APPL %--- AVG 1.53 ACTUAL SSCHRT 83.3 IOC CPU 9.1 CP 1.78 MPL 1.53 EXECUTION RESP 9.9 CPU SRB 1.4 AAPCP 0.00 ENDED 2 QUEUED 0 CONN 9.5 MSO 0 RCT 0.0 IIPCP 0.00 END/S 0.00 R/S AFFIN 0 DISC 0.3 SRB IIT 0.2 #SWAPS 120 INELIGIBLE 0 Q+PEND 0.1 TOT HST 0.0 AAP 0.00 EXCTD 0 CONVERSION 0 IOSQ 0.0 /SEC 593 AAP 0.0 IIP 0.00 AVG ENC 0.00 STD DEV 0 IIP 0.0 REM ENC 0.00 ABSRPTN 387 MS ENC 0.00 TRX SERV 387 GOAL: EXECUTION VELOCITY 10.0% VELOCITY MIGRATION: I/O MGMT 97.0% INIT MGMT 97.0% RESPONSE TIME EX PERF AVG USING% EXECUTION DELAYS % SYSTEM VEL% INDX ADRSP CPU AAP IIP I/O TOT CPU I/O SYSD --N/A

34 Measurements with IPSec On One ziip Run (3) REPORT BY: POLICY=WLMPOL WORKLOAD=ONL_WKL SERVICE CLASS=IPSEC RESOURCE GROUP=*NONE CRITICAL =NONE TRANSACTIONS TRANS-TIME HHH.MM.SS.TTT --DASD I/O-- ---SERVICE---- SERVICE TIMES ---APPL %--- AVG 1.00 ACTUAL 0 SSCHRT 0.0 IOC 0 CPU CP MPL 1.00 EXECUTION 0 RESP 0.0 CPU 4001K SRB 0.0 AAPCP 0.00 ENDED 0 QUEUED 0 CONN 0.0 MSO 0 RCT 0.0 IIPCP END/S 0.00 R/S AFFIN 0 DISC 0.0 SRB 0 IIT 0.0 #SWAPS 0 INELIGIBLE 0 Q+PEND 0.0 TOT 4001K HST 0.0 AAP 0.00 EXCTD 0 CONVERSION 0 IOSQ 0.0 /SEC 6668 AAP 0.0 IIP AVG ENC 1.00 STD DEV 0 IIP 83.9 REM ENC 0.00 ABSRPTN 6668 MS ENC 0.00 TRX SERV 6668 GOAL: EXECUTION VELOCITY 40.0% VELOCITY MIGRATION: I/O MGMT 69.5% INIT MGMT 69.5% RESPONSE TIME EX PERF AVG USING% EXECUTION DELAYS % SYSTEM VEL% INDX ADRSP CPU AAP IIP I/O TOT IIP CPU SYSD --N/A IPSec has been turned on inside TCPIP stack so enclave is created Current workload IS using IPSec This is the service class which will contain IPSec cycles 34

35 Measurements with IPSec On Two ziips Run (4) C P U A C T I V I T Y z/os V1R8 SYSTEM ID SYSD START 04/26/2007- RPT VERSION V1R8 RMF END 04/26/2007- CPU 2094 MODEL 744 H/W MODEL S54 ---CPU--- ONLINE TIME LPAR BUSY MVS BUSY CPU SERIAL I/O TOTAL NUM TYPE PERCENTAGE TIME PERC TIME PERC NUMBER INTERRUPT RATE 0 CP B10E CP B10E CP B10E CP B10E CP TOTAL/AVERAGE IIP B10E 9 IIP B10E IIP AVERAGE

36 Measurements with IPSec On Two ziips Run (4) REPORT BY: POLICY=WLMPOL WORKLOAD=DB_WKL SERVICE CLASS=DDFDEF RESOURCE GROUP=*NONE CRITICAL =NONE TRANSACTIONS TRANS-TIME HHH.MM.SS.TTT --DASD I/O-- ---SERVICE---- SERVICE TIMES ---APPL %--- AVG 3.00 ACTUAL 0 SSCHRT 0.0 IOC 0 CPU CP MPL 3.00 EXECUTION 0 RESP 0.0 CPU 51952K SRB 0.0 AAPCP 0.00 ENDED 0 QUEUED 0 CONN 0.0 MSO 0 RCT 0.0 IIPCP END/S 0.00 R/S AFFIN 0 DISC 0.0 SRB 0 IIT 0.0 #SWAPS 0 INELIGIBLE 0 Q+PEND 0.0 TOT 51952K HST 0.0 AAP 0.00 EXCTD 0 CONVERSION 0 IOSQ 0.0 /SEC AAP 0.0 IIP AVG ENC 3.00 STD DEV 0 IIP REM ENC 0.00 ABSRPTN 29K MS ENC 0.00 TRX SERV 29K GOAL: EXECUTION VELOCITY 50.0% VELOCITY MIGRATION: I/O MGMT 62.6% INIT MGMT 62.6% RESPONSE TIME EX PERF AVG USING% EXECUTION DELAYS % SYSTEM VEL% INDX ADRSP CPU AAP IIP I/O TOT CPU IIP SYSD --N/A A transaction consumes 20 msec of CPU time Transaction Rate = msec per sec/20 msec per tran = 161 transactions/sec Transactions delayed due to CPU delay 36

37 Measurements with IPSec On Two ziips Run (4) REPORT BY: POLICY=WLMPOL REPORT CLASS=RTCPIP DESCRIPTION =Report Class for TCPIP TRANSACTIONS TRANS-TIME HHH.MM.SS.TTT --DASD I/O-- ---SERVICE---- SERVICE TIMES ---APPL %--- AVG 1.00 ACTUAL 0 SSCHRT 0.0 IOC 0 CPU 0.2 CP 1.44 MPL 1.00 EXECUTION 0 RESP 0.0 CPU 4373 SRB 8.5 AAPCP 0.00 ENDED 0 QUEUED 0 CONN 0.0 MSO 0 RCT 0.0 IIPCP 0.00 END/S 0.00 R/S AFFIN 0 DISC 0.0 SRB IIT 0.0 #SWAPS 0 INELIGIBLE 0 Q+PEND 0.0 TOT HST 0.0 AAP 0.00 EXCTD 0 CONVERSION 0 IOSQ 0.0 /SEC 388 AAP 0.0 IIP 0.00 AVG ENC 0.00 STD DEV 0 IIP 0.0 REM ENC 0.00 ABSRPTN 388 MS ENC 0.00 TRX SERV 388 REPORT BY: POLICY=WLMPOL WORKLOAD=OMVS_WKL SERVICE CLASS=UNIX RESOURCE GROUP=*NONE CRITICAL =NONE TRANSACTIONS TRANS-TIME HHH.MM.SS.TTT --DASD I/O-- ---SERVICE---- SERVICE TIMES ---APPL %--- AVG 1.61 ACTUAL SSCHRT 80.0 IOC CPU 10.0 CP 1.92 MPL 1.61 EXECUTION RESP 9.9 CPU SRB 1.3 AAPCP 0.00 ENDED 2 QUEUED 1 CONN 9.5 MSO 0 RCT 0.0 IIPCP 0.00 END/S 0.00 R/S AFFIN 0 DISC 0.3 SRB IIT 0.2 #SWAPS 120 INELIGIBLE 0 Q+PEND 0.1 TOT HST 0.0 AAP 0.00 EXCTD 0 CONVERSION 0 IOSQ 0.0 /SEC 627 AAP 0.0 IIP 0.00 AVG ENC 0.00 STD DEV 0 IIP 0.0 REM ENC 0.00 ABSRPTN 390 MS ENC 0.00 TRX SERV 390 GOAL: EXECUTION VELOCITY 10.0% VELOCITY MIGRATION: I/O MGMT 96.6% INIT MGMT 96.6% RESPONSE TIME EX PERF AVG USING% EXECUTION DELAYS % SYSTEM VEL% INDX ADRSP CPU AAP IIP I/O TOT CPU I/O SYSD --N/A

38 Measurements with IPSec On Two ziips Run (4) REPORT BY: POLICY=WLMPOL WORKLOAD=ONL_WKL SERVICE CLASS=IPSEC RESOURCE GROUP=*NONE CRITICAL =NONE TRANSACTIONS TRANS-TIME HHH.MM.SS.TTT --DASD I/O-- ---SERVICE---- SERVICE TIMES ---APPL %--- AVG 1.00 ACTUAL 0 SSCHRT 0.0 IOC 0 CPU CP 0.04 MPL 1.00 EXECUTION 0 RESP 0.0 CPU 3516K SRB 0.0 AAPCP 0.00 ENDED 0 QUEUED 0 CONN 0.0 MSO 0 RCT 0.0 IIPCP 0.04 END/S 0.00 R/S AFFIN 0 DISC 0.0 SRB 0 IIT 0.0 #SWAPS 0 INELIGIBLE 0 Q+PEND 0.0 TOT 3516K HST 0.0 AAP 0.00 EXCTD 0 CONVERSION 0 IOSQ 0.0 /SEC 5860 AAP 0.0 IIP AVG ENC 1.00 STD DEV 0 IIP REM ENC 0.00 ABSRPTN 5860 MS ENC 0.00 TRX SERV 5860 GOAL: EXECUTION VELOCITY 40.0% VELOCITY MIGRATION: I/O MGMT 34.3% INIT MGMT 34.3% RESPONSE TIME EX PERF AVG USING% EXECUTION DELAYS % SYSTEM VEL% INDX ADRSP CPU AAP IIP I/O TOT IIP CPU SYSD --N/A IPSec has been turned on inside TCPIP stack so enclave is created Current workload IS using IPSec This is the service class which will contain IPSec cycles 38

39 Summary IBM Washington Systems Center The ziip is a cost effective way to implement IPSec on a z9 processor Reduced cost of the hardware Majority of IPSec cycles are eligible to run on the ziip No Impact on the MSU of the processor Implementation protects high priority, time sensitive ziip eligible workloads Independent enclave is managed by WLM to your performance objectives Accuracy of the projection tool results can be influenced by: Other ziip exploiters Latent demand 39

40 Questions IBM Washington Systems Center What About... 40