Integrating the Hardware Management Console s Broadband Remote Support Facility into your Enterprise

Transcription

1 System z Integrating the Hardware Management Console s Broadband Remote Support Facility into your Enterprise SC

2

3 System z Integrating the Hardware Management Console s Broadband Remote Support Facility into your Enterprise SC

4 Note Before using this information and the product it supports, read the information in Appendix D, Notices, on page 29. First Edition (February 2009) This edition applies to IBM System z Hardware Management Console at Version and higher using Broadband Remote Support Facility. There may be a newer version of this document in PDF format available on Resource Link.Goto and click on Library on the navigation bar. A newer version is indicated by a lower case, alphabetic letter following the form number suffix (for example: 00a, 00b, 01a, 01b). Copyright International Business Machines Corporation US Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

5 Contents About this publication v Chapter 1. Security features on the Hardware Management Console Data encryption using Secure Sockets Layer/Transport Layer Security Isolation of Ethernet connections Hardware Management Console firewall Chapter 2. Integrating Hardware Management Console broadband into your Enterprise Outbound connections for service Integrating the customer s firewall Support for an HTTP proxy server Checklist for setting up broadband RSF connectivity Chapter 3. Configuration example for broadband RSF Configuring network settings on the Hardware Management Console Verifying your network setup Customizing outbound connectivity Appendix A. IP Addresses for the IBM Service Support System Appendix B. Secure Sockets Layer and Transport Layer Security Secure Sockets Layer Transport Layer Security Appendix C. Frequently asked questions (FAQ) Appendix D. Notices Trademarks Copyright IBM Corp iii

6 iv Broadband RSF

7 About this publication Since the introduction of the System z9 Enterprise Class, the Hardware Management Console (HMC) has supported multiple connectivity options to the IBM Service Support System: v Dialup Remote Support Facility (RSF) (a dedicated modem and phone line) v Using an Internet (Broadband) connection. Configuring RSF to use a broadband connection is a significant improvement over service communication relying on a phone line. These benefits include: v Faster data transmission v v v v Ability to transmit more data on an initial problem request potentially resulting in more rapid problem resolution Improved transmission reliability Reduced customer expenses (for example, the cost of a dedicated analog telephone line) Capability to integrate with corporate firewall security policies. Clearly, using broadband RSF will give you the fastest and most reliable problem resolution. There are number of options available to set up a broadband Hardware Management Console connection that keeps your system secure and still satisfy your corporate security requirements. This document will describe the security features built into the Hardware Management Console to support broadband RSF, configuration options, and explain how to integrate security features in your Enterprise to work with broadband RSF. There is also step-by-step instructions for setting up broadband RSF from the Hardware Management Console. Copyright IBM Corp v

8 vi Broadband RSF

9 Chapter 1. Security features on the Hardware Management Console Broadband support on the Hardware Management Console (HMC) was designed with the understanding that maintaining security of the system is a shared responsibility between IBM and the customer. The following are built-in facilities on the Hardware Management Console: v Data encryption using SSL/TLS v Isolation of Ethernet connections v Hardware Management Console firewall. Data encryption using Secure Sockets Layer/Transport Layer Security All data between the customer machine and IBM is encrypted using Transport Layer Security (TLS) sockets, sometimes referred to as SSLv4. Secure Sockets Layer (SSL) technology ensures data confidentiality and integrity. The initial handshake uses a public, private, or both asymmetric 1024-bit key. After the initial handshake, a symmetric key and encryption algorithm is negotiated between the Hardware Management Console and the IBM Service Support System. IBM Service Support Systems use a symmetric 128-bit Rivest Cipher 4 (RC4) encryption or a symmetric 256-bit Advanced Encryption Standard (AES). For more information on SSL/TLS protocol, see Appendix B, Secure Sockets Layer and Transport Layer Security. Isolation of Ethernet connections There are multiple network interface cards available on the Hardware Management Console. This allows you to isolate your support elements from any possible access on the enterprise LAN. IBM recommends you use one of the Ethernet connections on each Hardware Management Console to connect to a private Ethernet LAN that communicates with your CPCs and support elements. Another Ethernet connection on the Hardware Management Console should connect to the enterprise LAN or corporate firewall that will in turn connect to the Internet. Figure 1 on page 2 shows this type of configuration. Support for Internet Protocol Version 6 (IPv6) was introduced with Hardware Management Console Version IPv6 can be used in any of the connections in the customer environment, including the outgoing connection to the Internet for service and support. Copyright IBM Corp

10 Figure 1. Separating Ethernet adapters In Figure 1, the Hardware Management Console uses a second network card to physically separate the local system network from the Internet-enabled network. Hardware Management Console firewall The Hardware Management Console is always protected by an internal firewall that allows outbound SSL traffic to the IBM Service Support System. The default is to block all inbound ports, which ensures that all service communication is initiated by the HMC. The IBM Service Support System will never initiate an Internet connection. Specific ports are only enabled as needed based on the IP addresses of the defined CPCs and enabled services (such as Web browser access). 2 Broadband RSF

11 Chapter 2. Integrating Hardware Management Console broadband into your Enterprise Outbound connections for service A customer firewall that is connected to the Hardware Management Console must be configured to allow outbound connections to the IBM Service Support System. All connections to the IBM Service Support System are outbound connections to port 443. The set of specific IP addresses to which your system requires outbound connectivity depend upon the following: v HMC version code v Internet protocol (IPv4 and IPv6) v Geographic location of your system. For a list of these addresses, see Appendix A, IP Addresses for the IBM Service Support System. A list of these IP addresses is also available in the online help information on the Hardware Management Console. To view the help, click Help on the Outbound Connectivity Settings window in the Customize Outbound Connectivity task. Integrating the customer s firewall The customer s firewall may also take advantage of Source Network Address Translation (SNAT) and masquerading rules to conceal the Hardware Management Console s Internet address from the packets in the Internet. The firewall may also limit the specific IP addresses to which the Hardware Management Console can connect. Support for an HTTP proxy server A customer may additionally require all traffic to go through a proxy server. In this case, the Hardware Management Console connects directly to the proxy server, which initiates all communications to the Internet (Figure 2). HTTP proxy support was introduced in Hardware Management Console Version Figure 2. HMC broadband using an SSL proxy server Copyright IBM Corp

12 To forward SSL sockets, the proxy server must support the basic proxy header functions (RFC 2616) and the CONNECT method. Optionally, basic proxy authentication (RFC 2617) may be configured so that the Hardware Management Console authenticates before attempting to forward sockets through the proxy server. For the Hardware Management Console to communicate successfully, the HTTP proxy server or firewall must allow outbound connections to port 443. The proxy server may limit the specific IP addresses to which the Hardware Management Console can connect. For a list of these required IP addresses, see Appendix A, IP Addresses for the IBM Service Support System. 4 Broadband RSF

13 Checklist for setting up broadband RSF connectivity The following checklist shows how the Hardware Management Console and Site Security Administrator teams might collaborate while configuring the HMC for broadband RSF. Step Description Data Status 1 Ensure that one of the HMC Ethernet adapters is configured to the enterprise LAN (see Isolation of Ethernet connections on page 1). Unless DHCP is used, record the IP address to configure. 2 Record default gateway to corporate network. 3 Customize Network Settings on the HMC for that Ethernet adapter. 4 Record the IBM Service Support System IP addresses that will be used. (See Appendix A, IP Addresses for the IBM Service Support System. ) 5 Contact your site s security administrator to configure firewall permission to establish outbound connections to port 443 using the IP addresses from step 4. 6 Contact your site s security administrator to determine whether the HMC is required to connect to an HTTP proxy, and that the proxy conforms to the requirements described in Support for an HTTP proxy server on page 3. Use DHCP? If not, IP address: Network mask: Gateway Address: Port: 443 IP addresses: If no, go to step Record the Internet address and port number that will be used by the HMC to connect to the HTTP proxy. 8 Determine whether authentication is required to connect to the HTTP. If so, record the userid and password to be used by the HMC to connect to the proxy. 9 Contact your site s security administrator to ensure that the HTTP proxy server has required permission to establish outbound connections to port 443 using the IP addresses from step Record version of Internet used (IPv4 or IPv6) 11 Configure outbound connectivity on the HMC. 12 Test connectivity to the IBM Service Support System. IP address: Port: Connect Userid: Password: Protocol to Internet: Chapter 2. Integrating Hardware Management Console broadband into your Enterprise 5

14 6 Broadband RSF

15 Chapter 3. Configuration example for broadband RSF This chapter contains one example of how to modify a Hardware Management Console (already set up as a call home server using dial support) to use broadband. The windows shown in the example reflect the Hardware Management Console Version at Version The step numbers in the following table corresponds to the step numbers in the checklist on page 5. Step Configuration Question Configuration Answer 1 What is the IP address and network mask assigned for the HMC on the corporate network? 2 What is the IP address of the default gateway in the corporate network? 7 Is the connection through an HTTP proxy server? If so, what is its port and IP address? 8 Does the HTTP proxy require authentication? If so, what is the userid and password? 10 Is the connection to the Internet IPV4 or IPv6? Not DHCP IP address: Network Mask: Gateway address: Gateway device: eth0 Yes IP address: Port: 8000 No authentication required Protocol to internet: IPv4 Note: You will use the configuration answers from this example table in the following procedures. Copyright IBM Corp

16 Configuring network settings on the Hardware Management Console 1. Log on to the Hardware Management Console in ACSADMIN or SERVICE mode. 2. If you are using the tree style interface: a. In the navigation pane in the left portion of the window, click HMC Management. b. In the tasks pad in the bottom portion of the work pane, under Configuration, click Customize Network Settings. or If you are using the classic style interface: a. Open Console Actions from the Views area. 8 Broadband RSF

17 b. Open Hardware Management Console Settings from the Console Actions Work Area. c. Open Customize Network Settings. Chapter 3. Configuration example for broadband RSF 9

18 3. The Customize Network Settings window is displayed. 4. Click the LAN Adapters tab. If there are more than one LAN adapters listed, click on the Ethernet LAN adapter that is connected to your corporate network (in this example, Ethernet eth0 00:14:5E:87:18:C2 ( )). 5. Click Details. The LAN Adapter Details window is displayed. 6. On the Basic Settings tab, click the Specify an IP address radio button. Enter the static IP address and the network mask (from step 1 in the example table). 7. Click OK to save the information. 10 Broadband RSF

19 8. Click the Routing tab. Enter the default gateway address and the gateway device eth0 (from step 2 in the example table). In the example below, route daemon is not enabled. Note: If you wanted to use RIP protocol for the dynamic routing path selection, click on Enable routed. 9. Click OK to save the information. 10. The Network Settings Update window is displayed. 11. Click OK. AQuestion pop-up window may display. Chapter 3. Configuration example for broadband RSF 11

20 Verifying your network setup At this point, the Hardware Management Console network configuration is complete. One way to verify that this is successful is to ping the default gateway. Note: This may not be permitted in your installation. If it is allowed: 1. If you are using the tree style interface: a. In the navigation pane in the left portion of the window, click HMC Management. b. In the tasks pad in the top portion of the work pane, click Network Diagnostic Information. or If you are using the classic style interface: a. Open Console Actions from the Views area. 12 Broadband RSF

21 b. Open Network Diagnostic Information from the Console Actions Work Area. 2. The Network Diagnostic Information window is displayed. 3. On the Ping tab window, enter (the default gateway address from step 2 in the example table) and click Ping Chapter 3. Configuration example for broadband RSF 13

22 4. If the ping completes successfully, the message 5 packets transmitted, 5 received, 0% packet loss is displayed. Continue with Customizing outbound connectivity on page If the ping does not complete successfully, here are some common things to check for: v Ping not permitted to the gateway v Wrong IP address or netmask setting in the Hardware Management Console v Wrong default gateway IP address v Properly seated Ethernet cable on the Hardware Management Console side or hub. v Wrong Ethernet media speed. Try Auto-detection. v Ethernet adapter card not recognized by the Hardware Management Console. Check resource name of Ethernet card (in this example eth0) by clicking the Interfaces tab. 14 Broadband RSF

23 Customizing outbound connectivity 1. Log on to the Hardware Management Console in ACSADMIN or SERVICE mode. 2. If you are using the tree style interface: a. In the navigation pane in the left portion of the window, click Service Management. b. In the tasks pad in the bottom portion of the work pane, under Configuration, click Customize Outbound Connectivity. or If you are using the classic style interface: a. Open Console Actions from the Views area. Chapter 3. Configuration example for broadband RSF 15

24 b. Open Hardware Management Console Settings from the Console Actions Work Area. c. Open Customize Outbound Connectivity. 16 Broadband RSF

25 3. The Call-Home Server Consoles window is displayed. Note: If your Hardware Management Console is at Version or earlier, this window does not display. Go to step Click Configure. The Outbound Connectivity Settings window is displayed. Note: On Hardware Management Consoles at Version or earlier, the window is called Customize Outbound Connectivity. Chapter 3. Configuration example for broadband RSF 17

26 5. Ensure that the Enable the local console as a call-home server is selected. 6. Click the Internet tab. 7. Select the Allow an existing Internet connection for service check box. Notes: a. Most customers will connect to the IPv4 Internet only. b. If you already have a local modem configured, you may choose to keep it available as a back up. If both Internet and modem are configured, the Hardware Management Console will always attempt to connect to the IBM Service Support System through its Internet connection. Only in case of failure, would the request go through the modem. 8. Verify if connection is through a proxy server. v If yes (from step 7 in the example table), continue with step 9. v If no, go to step Select the Use SSL proxy check box. 10. In the Address field, enter the IP address InthePort field, enter the port address 8000 (from step 7 in the example table). 11. Check if proxy authentication is required. v If no, (from step 8 in the example table), go to step 13. v If yes, continue with step Select the Authenticate with the SSL proxy check box. Enter the user name and password. 13. In the Protocol to Internet list, select IPv4 (from step 10 in the example table). 18 Broadband RSF

27 14. Click Test. The Test Internet window is displayed. 15. Click Start to verify that a broadband RSF connection can be made. Chapter 3. Configuration example for broadband RSF 19

28 16. A series of information messages display in the Test Status message box. 17. If the connection is successful, Test completed successfully is displayed. 18. If the connection was not successful, record the error message and click Help. The Test Internet help window is displayed. Select Test Status. A list of common error messages are displayed. Follow the instructions on the window. 20 Broadband RSF

29 Appendix A. IP Addresses for the IBM Service Support System A customer firewall between the Hardware Management Console and the Internet must be configured to allow outbound connections to the IBM Service Support System. All connections to the IBM Service Support System are outbound connections to port 443. v For Hardware Management Consoles at Version or earlier, you must allow access to the following IPv4 addresses: and (allow Hardware Management Console access to System Authentication Service (SAS)) and (allows Hardware Management Console access to IBM Service for North or South America) and (allow Hardware Management Console access to IBM Service for all other regions). v v Note: You only need to specify the IP addresses necessary to set up access to SAS and those appropriate for your region. For Hardware Management Consoles at Version , using IPv4 requires outbound connectivity to the following IP addresses: For Hardware Management Consoles at Version or later, Internet connectivity to the IBM Service Support System has been enhanced to enable access from the IPv6 internet as well as the IPv4 internet. If you require access to the IBM Service Support System using the IPv6 internet, you must allow access to all of these additional addresses: 2620:0:6C0:1:: :0:6C1:1:: :0:6C2:1::1000 Copyright IBM Corp

30 22 Broadband RSF

31 Appendix B. Secure Sockets Layer and Transport Layer Security Secure Sockets Layer The Secure Sockets Layer (SSL), originally created by Netscape, is the industry standard for session encryption between clients and servers. SSL uses asymmetric or public key cryptography to encrypt the session between a server and client. The client and server applications negotiate a cipher suite and symmetric session key for use in that connection. The key expires automatically and the SSL process creates a different key for each server connection and each client. Consequently, even if unauthorized users intercept and decrypt a session key, they cannot use it to eavesdrop on later sessions. Figure 3 shows an SSL encryption handshake sequence. Client Handshake start 3. Check trust status of the certificate Secret key 6. Creates a secret key and encrypts it using the server s public key Public Application Data 1. Request secure connection (Client Hello) 2. Send server s certificate to client (Server Hello); optionally requests client certificate 4. Send available ciphers to the server; optionally sends client certificate to the server 5. Send chosen cipher to client 7. Send the encrypted secret key to the server Secure Data Flow Private Server Application Data 8. Decrypts secret key using server s private key Secret key 1. Client requests secure connection to the server (Client Hello) 2. Server sends server s certificate to the client (Server Hello) 3. Client checks trust status of the server s certificate. Client checks if the server s domain name in server s certificate is included in the trusted domain list. Server s public key is embedded in the server s certificate (green key) 4. Client sends available ciphers list to the server 5. Server sends chosen cipher to the client. 6. Client creates a one-time secret key (yellow key ) for encrypted communication and encrypts the one-time secret key with server s public key that is embedded in the server s certificate. 7. Client sends the encrypted one-time secret key to the server. 8. Server decrypts secret key using server s private key (blue key). Figure 3. SSL encryption handshake sequence Copyright IBM Corp

32 Transport Layer Security Based on SSL Version 3.0, Transport Layer Security (TLS) Version 1.0 is the latest industry standard SSL protocol. Its specifications are defined by the Internet Engineering Task Force in RFC TLS provides the following security improvements overs SSL Version 3.0: v Key-hashing for message authentication code TLS uses keyed-hash Message Authentication Code (HMAC), which ensures that a record cannot be altered while traveling over an open network, such as the Internet. SSL Version 3.0 also provides keyed message authentication, but HMAC is considered more secure than the Message Authentication Code function that SSL Version 3.0 uses. v Enhanced pseudo random function Pseudo Random Function (PRF) is used for generating key data. In TLS, the PRF is defined with the HMAC. The PRF uses two hash algorithms in a way that guarantees its security. If either algorithm is exposed, then the data will remain secure as long as the second algorithm is not exposed. v Improved finished message verification Both TLS Version 1.0 and SSL Version 3.0 provide a finished message to both end points that authenticates that the exchanged messages were not altered. However, TLS bases this finished message on the PRF and HMAC values, which again is more secure than the SSL Version 3.0. v Consistent certificate handling Unlike the SSL Version 3.0, TLS attempts specify the type of certificate that must be exchanged between TLS implementations. 24 Broadband RSF

33 Appendix C. Frequently asked questions (FAQ) The following is a set of questions and answers regarding Remote Support Facility (RSF) security on Hardware Management Consoles at Version or higher. RSF connections may be made by either a modem or Internet broadband. The broadband connection capability is only available on Hardware Management Consoles at Version or higher. Note: These FAQs are intended to address most security questions. For additional information, have your IBM service representative document your question into a PMH record for Product Engineering to answer. Does IBM initiate a connection into a customer system with Hardware Management Console or higher? No. Remote support connections for service are always initiated by the customer s Hardware Management Console to IBM. An inbound connection is never initiated from the IBM Service Support System. How are RSF connections made? There are two types of connections: v Dialup connection over a modem If a modem is used, the protocol is point-to-point and TCP/IP. All data transfer is done using SSL encryption. Phone connections are made using an IBM selected global service provider. Provision is made for the use of local phone connections where available. The IBM selected global service provider limits access for these connections to a restricted set of destination IP addresses. General access to and from the Internet is blocked. v Internet connection If an Internet connection is used, all communications are handled through TCP sockets initiated by the Hardware Management Console and use a high-grade SSL to encrypt the data that is transmitted. The destination TCP/IP addresses are published to enable you to set up firewalls allowing connection. How does the IBM Service Support System validate the incoming call? The IBM Service Support System validates that the incoming requesting system is known and authorized, or the connection is dropped. There are three different validations for each incoming call. v v v The global service provider validates userid and password for the point-to-point connection. The Hardware Management Console validates the trusted host by a digital signature issued for the IBM Service Support System when initializing the SSL encrypted connection. IBM Service Support System also validates decrypted data from the Hardware Management Console and performs an entitlement check. What data is transferred through the RSF connection? All data transferred is for service use only. No customer data is transferred. Copyright IBM Corp

34 Is data transferred from IBM to the customer system encrypted? Yes. All data transferred from IBM to the customer system is encrypted and checked prior to use. What level of SSL encryption is used by the Hardware Management Console? The Hardware Management Console uses 128-bit encryption. Are the RSF data exchange protocols published? No. All the data exchange protocols are proprietary to IBM service and not published. Does the Hardware Management Console have an internal firewall? The Hardware Management Console enhancements included an always active internal firewall that has default policy of blocking all inbound ports. Specific ports are only enabled as needed based on the IP addresses of the defined CPCs and enabled services (such as Web browser access). Is there customer access to the underlying system of the Hardware Management Console? No. The Hardware Management Console is a closed platform and only IBM can put code on the system. Does the Hardware Management Console answer an incoming call through a modem by default? The Hardware Management Console, by default, will not answer an incoming call through a modem. (This can be changed by the customer if desired to allow remote connections to the Hardware Management Console.) Regarding security, what changes to Hardware Management Consoles at Version or higher have been implemented compared to consoles at Version and lower? The Hardware Management Console enhancements include an always active internal firewall that has a default policy of blocking all inbound ports. Specific ports are only enabled, as needed, based on the IP addresses of the defined CPCs and enabled services (such as Web browser access). 26 Broadband RSF

35 What servers are supported on the new Hardware Management Console? Version supports the following: Server Machine Type G5, G z900, z , 2066 z990, z , 2086 z9 EC, z9 BC 2094, 2096 Version supports the following: Server Machine Type G5, G z900, z , 2066 z990, z , 2086 z9 EC, z9 BC 2094, 2096 z10 EC 2097 Version supports the following: Server Machine Type G5, G z900, z , 2066 z990, z , 2086 z9 EC, z9 BC 2094, 2096 z10 EC, z10 BC 2097, 2098 Can the Hardware Management Console connect using a NAT router to the Internet? Yes. No Hardware Management Console configuration is required. Does the Hardware Management Console support HTTP proxy or proxy in general? No if the Hardware Management Console Version is at or lower; Yes if the Hardware Management Console is at Version and higher. What operating system is used for Hardware Management Console at and higher? An IBM proprietary imbedded operating system is used. If I require additional information not covered in this section, how can I get more information? Request your IBM service representative to open a PMH record with your question. Product Engineering will review your question and answer it. Appendix C. Frequently asked questions (FAQ) 27

36 28 Broadband RSF

37 Appendix D. Notices This information was developed for products and services offered in the U.S.A. IBM may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM representative for information on the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the user s responsibility to evaluate and verify the operation of any non-ibm product, program, or service. IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not grant you any license to these patents. You can send license inquiries, in writing, to: IBM Director of Licensing IBM Corporation North Castle Drive Armonk, NY U.S.A. The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local law: INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION AS IS WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you. This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice. Any references in this information to non-ibm Web sites are provided for convenience only and do not in any manner serve as an endorsement of those Web sites. The materials at those Web sites are not part of the materials for this IBM product and use of those Web sites is at your own risk. IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you. Any performance data contained herein was determined in a controlled environment. Therefore, the results obtained in other operating environments may vary significantly. Some measurements may have been made on development-level systems and there is no guarantee that these measurements will be the same on generally available systems. Furthermore, some measurements may have been estimated through extrapolation. Actual results may vary. Users of this document should verify the applicable data for their specific environment. Copyright IBM Corp

38 Information concerning non-ibm products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-ibm products. Questions on the capabilities of non-ibm products should be addressed to the suppliers of those products. All statements regarding IBM s future direction or intent are subject to change or withdrawal without notice, and represent goals and objectives only. All IBM prices shown are IBM s suggested retail prices, are current and are subject to change without notice. Dealer prices may vary. This information is for planning purposes only. The information herein is subject to change before the products described become available. This information contains examples of data and reports used in daily business operations. To illustrate them as completely as possible, the examples include the names of individuals, companies, brands, and products. All of these names are fictitious and any similarity to the names and addresses used by an actual business enterprise is entirely coincidental. If you are viewing this information softcopy, the photographs and color illustrations may not appear. Trademarks IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both. If these and other IBM trademarked terms are marked on their first occurrence in this information with a trademark symbol ( or ), these symbols indicate U.S. registered or common law trademarks owned by IBM at the time this information was published. Such trademarks may also be registered or common law trademarks in other countries. A current list of IBM trademarks is available on the Web at Copyright and trademark information at copytrade.shtml. Other products, companies, and service names be trademarks or service marks of others. 30 Broadband RSF

39

40 Printed in USA SC