DATAPOWER-CONFIG-MIB Table View

Configure the DNS name resolution service

Configure and manage Ethernet interfaces.

Table.

Creates an HTTP server. This server delivers documents stored on the local
system.

Use this page to establish Statistics settings. Statistics must be enabled
for some of the monitors to work correctly.

Allows the configuration of a trace target.

Configure remote NTP (Network Time Protocol) server. This allows the
automatic synchronization of the system clock.

This setting throttles, or disallows, traffic when the total memory
available to the system reaches the thresholds established here.

Create, Edit or Delete a Processing Policy. A policy consists of one or
more Processing Rules. Rules execute depending upon the direction of the
message and on whether or not a corresponding matching rule selects the
document for processing. A service may have only one policy active at a
time. Click Services in the left-hand navigation menu and then click the
appropriate policy link to use the graphical interface to create and edit
policies.

Use this page to configure a User Agent, which the device uses to retrieve
resources (for example, stylesheets or XML documents) from remote servers.
A User Agent can also affect the messages emitted by a Multi-Protocol
Gateway

Creates a TCP Proxy service.

Configure/Edit URL maps. URL Maps are used by Processing Actions and by
XML Manager Compile Options Policies.

Configure/Edit URL Refresh Policies

Create or edit a local user account. When you modify a local user account,
the changes do not affect remote user accounts in a role-based management
XML information file. An administrator can change the password for the
account. An administrator can force the account owner to change the
password during the next log in attempt.

Configure appliance-wide network settings.

An XML Manager manages the compilation and caching of stylesheets, the
caching of documents, and provides configuration constraints on the size
and parsing depth of documents. You can enable streaming operation by
configuring an XML Manager to use a Streaming Compile Option Policy. More
than one firewall may use the same XML Manager.

In IBM MQ, distributed send and receive queues are managed by a component
called a queue manager. The queue manager provides messaging services for
communicating applications by periodically monitoring/polling queues, by
ensuring that sent messages are directed to the correct receive queue, or
that messages are routed to another queue manager. This Queue Manager
object on the device corresponds to a Queue Manager running on another
host on the network. The properties set here enable communication between
the device and the Queue Manager.

The XSL Proxy service is deprecated. Creates an XSL Proxy on local IP/port
for server on remote IP/port. A loopback proxy does not require a remote
IP and port. The Proxy applies the selected XSL proxy processing policy to
messages flowing through the proxy (as requests, responses or both
directions). The proxy may apply the selected URL rewrite policy to client
requests. If needed, the proxy may communicate with either the back end
server or the requesting client using the SSL profiles selected.

Table.

Creates an SSL Proxy service. This service can be used to wrap or unwrap a
TCP stream in SSL. This service requires SSL profiles to secure the
connections. When the appliance is an SSL client, use a forward SSL proxy
profile or an SSL client profile to secure connections between the clients
and its targets. When the appliance is an SSL server, use a reverse SSL
proxy profile or an SSL server profile to secure connections between
clients and the appliance. When the server supports Server Name Indication
(SNI), you use an SSL SNI server profile. When the appliance is both an
SSL client and SSL server, use a two-way SSL proxy profile, or an SSL
client profile and an SSL server profile or SSL SNI server profile to
secure both connections.

Create, edit, or delete processing policy rules. Rules can also be created
and edited using a drag and drop interface by opening the Services menu
area on the left-hand navigation bar. Click the appropriate Policy link
which will then present an opportunity to create both Rules and Actions.

Failure notification is a serviceability tool. By default, failure
notification is disabled. To use failure notification, you must enable the
configuration and allow the error report to be uploaded. The uploading of
an error report allows the capture of more diagnostic information, which
safely improves serviceability. Although there is a tradeoff between
performance and serviceability, you should choose serviceability by
enabling the following properties: Include Internal State Background
Packet Capture Background Log Capture Background Memory Trace When you
allow the error report to be uploaded, this setting enables the Failure
Notification status provider. This status provide in combination with the
report history tracks the error reports that the appliance generates, the
reason why the appliance generated the error report, and its upload status
to the specific destination. You can specify an NFS, iSCSI (deprecated),
RAID, SMTP, or FTP destination. You can also specify the local temporary
directory as the destination. The appliance generates error reports, the
naming convention includes the serial number of the appliance and the
timestamp of the report. This naming convention prevents one report from
overwriting another. You can use Event Triggers to generate error reports
automatically when specific events occur.

Configure network Ethernet interfaces

Table.

System settings provide the following purposes. Define appliance-specific
information, such as contact information, location, and name. Update
serial number after a replacement. Enable interface for custom GUI
messages and custom CLI prompt. Reserve disk space for the audit log.
Define information about the hardware for use by the SNMP system table,
such as serial number, and model type

Use this page to establish SNMP connectivity to the device, and to set
values used by SNMP.

Global RADIUS configuration

Create or edit user groups and their access privileges.

The Shell Alias command is deprecated. Creates a user-defined macro that
runs the specified sequence of commands when invoked from the CLI. You can
use the GUI to create and modify macros, but you can invoke these macros
from only the CLI.

The XSL Coprocessor service is deprecated. Creates an XSL Coprocessor. An
XSL Coprocessor accepts input not from a client, as in XSL Proxy or XML
Firewall operation, but from a Java program or a plug-in equipped
application running on another machine on the local network. Messages are
sent to the coprocessor by the Java library or plug-in, the Coprocessor
then applies the Processing Rule selected and returns the result to the
calling routine. When the Rule is set to None, the CoProcessor uses the
XSL stylesheet supplied by the calling entity.

Telnet services on the appliance are Telnet handlers. They are available
for compatibility with earlier versions. A Telnet handler supports
client-initiated access to the CLI. Telnet is an unsecure protocol and
should be used with extreme caution. Telnet should be enabled only on the
trusted management port or on a secure network segment. To ensure an
encrypted connection and verify the cryptographic authenticity of the
server, SSH is a more secure choice.

A shared secret key is a sequence of characters that is pre-shared between
users for use with symmetric encryption.

Table.

Configure/Edit URL Rewrite Policies

The SSL proxy profile is deprecated. To secure the connections, use the
SSL client profile and SSL server profile or SSL SNI server profile based
on the role of the appliance. An SSL proxy profile is associated with a
DataPower service to describe how SSL connections should be made from or
to the proxy's port.

Defines an HTTP Proxy Service.

Table.

The set of crypto credentials (private keys, shared secret keys, and
certificates) usable by an xmlfirewall when calling security extension
functions to perform actions such as encryption/decryption and digital
signing and verification. If a firewall is using a Firewall Credentials
object and a particular certificate or key is not included in this list,
the cryptographic operation trying to use the key or certificate will
fail.

Create or edit an XML Firewall on local IP/port (device address and port).
This firewall may communicate with a dynamically identified server (or
servers), a static back end server (at an identified remote IP/port) or as
a loopback. The Firewall applies the selected processing policy to
messages flowing through the firewall (request, response or both
directions). Message content from client or server can be characterized as
soap, xml, Non-XML (preprocessed) or Pass-Thru (unprocessed) and verified
accordingly. The firewall may rewrite client request URLs using a URL
rewrite policy. The firewall may use SSL communications to client, server
or both directions if applicable.

The private key portion of a private/public key pair, as for RSA or DSA.

The public key portion of a private/public key pair, as for RSA or DSA,
plus the certificate with which the key pair is used.

An identification set consisting of a certificate (which contains a public
key) and the corresponding private key. The identification set is used as
the identity of an sslproxy, and the certificate is sent to an SSL peer
when negotiating an SSL connection. It may also be used as the identity
when signing, encrypting or decrypting documents.

A validation credentials list is used to authenticate certificates that
are received from SSL peers. It can also be used to validate certificates
that are used in digital signature and encryption operations. An SSL
client requires a Validation Credentials object only when it authenticates
the certificate presented by the remote SSL server. The SSL standard does
not require authentication of the server certificate. An SSL server
requires a Validation Credentials object only when it authenticates remote
SSL clients. The SSL standard does not require authentication of the
client certificate.

A crypto profile describes a set of configuration information for creating
SSL connections.

Log targets capture messages that are posted by the various objects and
services that are running on the appliance. Target types enable additional
capabilities that include rotating files, encrypting and signing files or
messages, and sending files to remote servers. Messages in log targets can
be restricted (filtered) by priority, event code, event category, object
type, or IP address. By default, a log target cannot accept messages until
it is subscribed to one or more events.

Modify the configuration of the SSH server.

Table.

Modify the configuration of the web management service.

Table.

Table.

Table.

Table.

Table.

Table.

Table.

Allows for the configuration of custom log categories

Modify the configuration of the XML management interface. This interface
is described in the store:///xml-mgmt.wsdl file in the 'default' domain.

Message Matching determines what messages will be monitored by any monitor
that uses the Message Matching object. It is a definition of the traffic
flow that is monitored. To capture all messages, set the HTTP Method field
to 'any' and leave all other fields blank.

On-Line Help for Message Types

On-Line Help for Message-Count Monitors

On-Line Help for Message-Duration Monitors. Duration Monitors observe the
duration, or amount of time, taken to process submissions.

On-Line Help for Monitor Policies (Filter Actions)

This defines the rules for handling HTTP to XML conversion of form values
in an HTTP GET or POST of a form. There are different conversion
(Encoding) rules for the values. They control how the value is mapped to
the contents of its <arg> element in the resulting XML. There is a default
Encoding, which is all that is required. There can also be specific
Encodings applied to values based on the name associated with a value,
which is done using an ordered list of PCREs.

Configure/Edit Compile Option Policies

An XPath Routing Map matches XPath expressions with corresponding
destination URLs. When the XPath expression evaluates to true when applied
to the message submitted, the target destination for the message is set to
the corresponding URL. Use the Rules tab to establish these mappings. Use
the Namespace Mapping tab to determine Namespace URIs for namespaces used
in the XPath Expressions.

This object describes exceptions to an XML Schema by identifying elements
of the schema that may be encrypted in an instance document. When Schema
Validation is performed on the document using this Exception Map,
encrypted elements are considered valid when they appear in place of the
specified elements.

Table.

A Document Crypto Map indicates which elements, of a complete schema, to
encrypt or decrypt. The indicated element or elements may also be signed.

A DataPower appliance can support multiple IBM Security Access Manager
registry types: LDAP or Microsoft Active Directory. Support for the
registry type is established for each Access Manager client that starts
according to its configuration.

An application domain contains the resources that support DataPower
services. A DataPower supports multiple application domains. Application
domains can share read access to files in their local: directory. All
application domains share the contents of the store: directory. After a
user logs in to an application domain, everything the user does applies to
only that application domain. Except for the default application domain,
all application domains can be restarted independently. For the default
application domain, you must restart the DataPower Gateway. When an
application domain or the DataPower Gateway is restarted, the persisted
configuration is used. The persisted configuration can differ from the
running configuration. The configuration of an application domain can be
locally stored or can be retrieved from a remote server. The use of a
remote configuration file enables centralized management of application
domains.

The time zone for the appliance. The time zone affects the time that the
appliance displays. All time stamps in the CLI and GUI use this time zone.
#b#Note: #/b#The appliance clock runs on Coordinated Universal Time (UTC).
When daylight saving time (DST), or summer time, applies to a time zone,
the appliance adjusts the time when a DST boundary is crossed.

Table.

Table.

Table.

An access control list (ACL) consists of a sequence of allow and deny
clauses. Each clause identifies an IP address or range of addresses that
allow or deny access to a service. After associating an ACL with a
service, the ACL grants access to addresses in allow clauses and denies
access to all other addresses. Candidate addresses are sequentially
evaluated against each clause in the ACL. A candidate address is denied or
granted access in accordance with the first clause that matches.
Consequently, the order of the clauses in the ACL is vital. An ACL with
only deny clauses effectively disables a service by denying access to all
addresses. To complete the ACL, include an allow clause to ensure that all
addresses that are not explicitly denied access are granted access.

Import Package allows the system to import a configuration package from an
external server, such as a centralized configuration server, when the
configuration of the DataPower system is reloaded (such as during a
reboot). This package can optionally overwrite existing files or objects.
An import package object specifies a source, content type and import
parameters for a single import bundle.

Table.

Table.

The DataPower device distributes traffic to members of a Load Balancer
Group. These are back end servers and not additional DataPower devices. A
Load Balancer Group lists members of a virtual server group and sets the
algorithm for balancing them. Periodic health checks can be performed.
Load Balancers may also be used to provide redundant LDAP server access.
Once created, a top-level service (such as Multi-Protocol Gateway or XML
Firewall) can use a Load Balancer Group by associating it with an XML
manager that is associated with the top-level service. The back end
destination URL is set to the name of the Load Balancer Group (example:
'BackEndServers').

Manage role-based management (RBM) settings: RBM, password policy, and
account policy RBM consists of the following capabilities: Authenticating
users, evaluating the access profile, enforcing access to resources The
password policy sets the password requirements for local user accounts.
The account policy sets the lockout behavior and the timeout for CLI
sessions.

Allows the inclusion of external configuration files during startup. The
included configuration files may reside on the local device or on a remote
host.

The Certificate Monitor periodically checks all X.509 certificates stored
on the device for expiration. The monitor automatically creates a log
message for each certificate that is within the Reminder time of
expiration. Expired certificates may be automatically disabled. Note that
the Monitor checks all certificates immediately when the Monitor is first
enabled.

A host alias is a map between a local IP address to a local alias. The
host alias is resolved like a static host entry. Host aliases provide a
level of abstraction between concrete network addresses and configuration.
You can use host aliases where you can define local IP addresses. Host
aliases ease the export and migration of service among DataPower
appliances. The alias is exported, but the alias map is not. If the alias
is defined on the destination system, the alias resolves to the IP address
that is defined on the destination system.

An AAA policy establishes the configuration to support the authentication
and authorization of users requesting resources from the back-end servers.
An AAA policy consists of the following components. Identity extraction
One of many methods that discovers which identity is asserted in the
service request. This processing phase answers the question, 'What is your
name?' Authentication One of many methods that authenticates the asserted
identity. Methods include communication with external authorities, such as
an LDAP server. The identity is accepted as authentic or rejected. When
authenticated successfully, the identity is used as a credential. Resource
extraction One of many methods that discovers which resource service is
requested (such as query an account or perform an update) This processing
phase answers the question, 'What do you want to do?' Credential mapping
While an identity can be authenticated by one authority as valid, this
identity or credential might not be known to the authority that authorizes
the requested resource. This processing phase allows the mapping of
credentials from one form to another for interoperability between systems.
Resource mapping While a resource can be identified from the service
request, this resource name might not be known to the authority that
authorizes use of the requested resource. This processing phase allows the
mapping of resource names from one form to another for interoperability
between systems. Authorization The combination of the authenticated and
possibly remapped credential with the requested and possibly remapped
resource are submitted to an authority for authorization. That authority
could reside elsewhere on the network. The request for service is accepted
or rejected. Postprocessing Additional processing to perform after
authorization, such as the generation of a WS-Trust token or SAML
assertion.

Define XSL filters and/or transformations

Table.

Web Service SLM (Service Level Monitor) Object An SLM watches Web Services
traffic destined for the Endpoint URL defined in the Endpoint URL field
using the transport method defined in the Transport Type field. The
monitor watches only traffic the client sent to the Front End URL (which
accepts wildcards). The Endpoint, Endpoint URL and Transport Type must
agree with the definitions provided in the WSDL file identified by the
WSDL URL field.

A Web Service Proxy virtualizes application services described by WSDL
files. The Proxy provides alternate endpoint URLs, message validation,
service level monitoring and automatic updating when provided with only
one or more WSDL files. In addition, a Web Service Proxy can provide the
full range of processing services available to an XML Firewall or
Multi-Protocol Gateway, such as Authentication and Authorization,
cryptographic operations, transformations and dynamic routing, and more.

Table.

Create, edit, or delete processing policy rules. Rules can also be created
and edited using a drag and drop interface by opening the Services menu
area on the left-hand navigation bar. Click the appropriate Policy link
which will then present an opportunity to create both Rules and Actions.

Create, Edit or Delete a Processing Policy. A policy consists of one or
more Processing Rules. Rules execute depending upon the direction of the
message and on whether or not a corresponding matching rule selects the
document for processing. A service may have only one policy active at a
time. Click Services in the left-hand navigation menu and then click the
appropriate policy link to use the graphical interface to create and edit
policies.

The Web Services Management Agent provides manageability for Web Services
by providing status, metrics, and transaction history to external
management stations.