Blackpipe User Document

Transcription

1 This document describes Blackpipe, Dresser Wayne s secure alternative to the Netbios-based directory sharing that was implemented as the back-office system (BOS) interaction mechanism for Nucleus (POS) systems. The intent is to provide a secure access method for back-office applications that protects sensitive customer data without major design and code changes to the back-office applications. Design Goals The design goals of this system were: 1. Keep all communications between POS and BOS encrypted and secure. 2. Only make outbound connections initiated by the POS to the BOS so that there are no ports open on the POS. 3. Mimic the directory-sharing actions of the current shared directory system so as to minimize (or completely obviate any need for) changes to the Nucleus software or to any third-party back-office software. In order to meet these goals, Blackpipe depends on the underlying PCIHopper technology which provides the actual file transfer system. PCIHopper is an HTTPS/REST-based protocol optimized to allow for simple file transfers over local-area networks. PCIHopper is asymmetric, so that the POS makes connections to the BOS periodically and either sends or retrieves files using simple secure HTTPS requests. Page 1

2 Implementation and Configuration (Nucleus) Blackpipe is currently implemented on all PCI-compliant versions of Nucleus. It is turned off by default on the Nucleus, but can be turned on at any time through Programming System Back Office Configuration. The interface requires the user to specify the IP address of the back office machine and once configured, Nucleus will automatically start attempting to communicate with a back office machine at that IP address. Once Blackpipe is enabled, NetBIOS can be disabled on the same screen. Although a reboot is not required for enabling/disabling Blackpipe, a reboot is required when changing the NetBIOS Enabled setting. Page 2

3 Installation (Back Office System (BOS) PC) On the back office side, a separate installer program is required to set up Blackpipe. To install the software, first make sure that there is a connection between the BOS PC and Nucleus. This can be verified by opening a command prompt on the BOS PC, and typing the ping command. Note that in the example below, the default IP address for the Nucleus server is used, and the command is typed from the root of the C: partition on the BOS PC. For your site, use the actual IP address of the Nucleus, if different than the default. C:\> ping If you do not know the IP Address of the Nucleus server, open a command prompt on Nucleus (you will need a Oneshot), and type the command below from the root of the C: partition. C:\> ipconfig Then insert the Blackpipe BackOffice Server Installer CD into the BOS PC CD-ROM drive. If the installer program does not launch automatically, follow the steps below to launch it. Double-click on the My Computer icon on the Widows desktop. If you do not have a My Computer icon, go to Start All Programs My Computer. Double-click on Blackpipe_CD Page 3

4 The Blackpipe Back Office Server Setup Wizard should launch. Click on Next. Review the software license agreement, and click on I Agree. Page 4

5 Accept the default location to install the software unless your BOS vendor has provided other instructions. Click on Install. If the software has already been installed, you may see a message asking if you want to shutdown the agent and start an upgrade. Select Yes to install a later version. Page 5

6 When the configuration screen appears, enter the IP Address of the Nucleus system. For most sites, the default address of will be correct. Use the same address that you used for the ping command on page 3 of this document. Enter the Local Directory to be used for file exchange (this replaces the mapped drive to the Nucleus system. If you do not have specific instructions from your BOS vendor for the location of the local mapped drive, accept the default location (C:\POS). Click Apply, and OK when you have finished entering your configuration settings. When the screen below appears, click Finish to exit the wizard. Page 6

7 IMPORTANT: You will need to have instructions from your BOS vendor on how to redirect the pricebook upload (PDI.DAT file) to go to the new local mapped directory. Also, it s important that there not be any firewalls blocking inbound TCP connections on the back office machine. If a firewall does exist, please ensure that inbound TCP connections on port 9020 are permitted. Ensure that there are no firewalls blocking inbound TCP connections on the back office machine. If a firewall does exist, please ensure that inbound TCP connections on port 9020 are permitted. o To check the firewall settings, go to Start Control Panel Windows Firewall settings (on Windows XP systems). o If the Firewall setting is On, click on the Exceptions tab. o Click the Add Port button. o Enter Blackpipe_9020 for Name. o Enter 9020 for Port. o Click OK. BOS Vendor (only) notes: Once installed on both the Nucleus and Back Office System, Blackpipe will start communicating and transferring files. Note that this is not a complete mirror application. Blackpipe has a set of rules (specified on the Nucleus side) that determines which side is authoritative on certain file patterns. In general, the application that created a file is usually authoritative on that file. Blackpipe uses the rules to determine which files to replicate to the other system. The current default set of rules is shown below. pdi * BOS drpintmp.* BOS pricebooksync/pdi.* BOS xmlimport/* BOS bosinax/import/* BOS hq/import/archive/* POS hq/import/error/* POS hq/import/* BOS * POS (I.e., for all files not matching the above rules, the POS wins). Page 7

8 When troubleshooting Blackpipe, it s important that your expectations about whether the file will be copied or not are correct. The rules shown on the previous page should help you determine whether you have the right expectations. Finally, regardless of which side is authoritative on a particular file, a deletion at either end will result in a deletion on the other side. This, again, is to mimic the way a shared directory works. Troubleshooting If you re not seeing files getting transferred as you expect, take the following steps to troubleshoot the connection: On the back office side, run the program Blackpipe.exe. To run it go to Start Programs Dresser Wayne Blackpipe Back Office Server Configure Blackpipe Back Office Server. Click on the Control tab, and you should see something like this: This screen gives you some basic info about the connection. The Last contact time is when the Nucleus last pinged the back office. If the application is working, this should be a time within the last minute or so. The Last file transferred time should be when an actual file was moved over. This may be many hours old depending on whether there s been some activity. The table below shows the transfer rules explained in the previous section. If they re there, it means that the Nucleus application has communicated with the back office and passed along the transfer rules. This application is a relatively user-friendly way to determine that Blackpipe is working. If it is not, a technician will need to get OneShot access to the Nucleus desktop. Once you re on the desktop of the Nucleus, the first step is simply to see if you can ping the back office machine using the standard windows ping command. If the ping fails, there is a basic connection issue between the Nucleus and the BOS machine. Page 8

9 If ping succeeds, the next step would be to see if you can make a connection to port 9020 on that machine. The simple way to do this in Windows is to use the telnet command: If the connection fails, as above, there is a connection issue. The most likely causes of connection issues are incorrectly configured networks, or firewall software on the back office box. Please have a network technician determine that these are not the case. Some may also find the following command useful on the Nucleus side. On a command prompt, cd to d:\insite\pcimirror_pos, and then run the following command. D:\InSite\pcimirror_pos>pipefitter.exe -n getstatus 9020 Upstream router addr: Upstream router port: 9020 Status Report Last connect: :06:29 UTC Last heartbeat: :40:06 UTC Send File Time: :39:32 UTC Receive File Time: :24:58 UTC Connect Error: Send File Error: Receive File Error: The times are in UTC (a.k.a. GMT), so you will need to do some conversion to check that the heartbeat time is within the last minute or two. If there is an error message on connect or file send or receive, it should show up under errors there. Page 9

10 StoreWatch from Aztech Software Inc. Blackpipe User Document StoreWatch is Blackpipe compliant starting with version 8.36K.18. Please make sure that you are running this version or higher. To determine which version you are on, login to StoreWatch and you will see the version listed on the top of the window: If you are not on at least this version, please contact Aztech Software Support at The following steps will need to be performed before the Blackpipe communications will properly function. After installing the Blackpipe Back Office Server and using ALL the suggested defaults, please launch StoreWatch and login. If you are unable to see the Setup menu make sure you have auditor privileges. After logging in proceed to: 1. Click Setup 2. Click Shift 3. Click Register Interface 4. Click Nucleus Configuration note: This opens the Nucleus Department setup window 5. Click the Parameters tab Page 10

11 6. Change the Communicate with the Nucleus option to Connect via Blackpipe 7. Change the Local Path to the Path chosen in the Blackpipe back Office Server installation. This typically is the default of C:\POS 8. Click the Update Parameters button 9. Click the Close button 10. Exit StoreWatch The following steps are required to remove the mapping of a network drive that was previously being used for Nucleus communications. 1. Click on My Computer 2. Click on the Drive mapped to N: note: if you do not see a drive letter mapped, you may skip to step 5 3. Click on the File menu 4. Click on the Disconnect option 5. Close the My Computer window With these steps complete, please REBOOT your PC Page 11