Building Secure Sun Fire Link Interconnect Networks Using Sun Fire 15K and Sun Fire 12K Servers
- Sun Fire Link Hardware Overview
- Sun Fire Link Software Overview
- System Configuration
- Fabric Configuration
- References
- Related Resources
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
In a distributed computer system, data is sent from one computer over a network to another computer. The data that is being sent across the network may be readable by unauthorized users. Data transmitted over the network is sensitive to privacy, authenticity, and point of origin attacks so it must be protected. The Sun Fire Link interconnect software is part of a distributed computer system, so it must be fortified against these attacks.
Deploying a secure distributed computer system can be difficult. This article describes how to install and deploy the Sun Fire Link product so that it can be securely managed and operated and documents the software architecture and the steps needed to secure the Sun Fire Link interconnect. The commands used in configuration steps are either Fire Link Manager (FM) or Solaris™ Operating Environment (Solaris OE) tools. This article requires a general knowledge of Solaris OE system administration and is written for advanced system administrators.
The article also includes a section on how to create, configure, and secure a Sun Fire Link fabric. The Sun Fire Link fabric is a collection of remote shared memory (RSM) partitions, compute nodes, and switch nodes.
This article covers the following topics:
"Sun Fire Link Hardware Overview" on page 2
"Sun Fire Link Software Overview" on page 4
"System Configuration" on page 7
"Fabric Configuration" on page 19
The main recommendations are:
-
Follow the guidelines in [1] "Building Secure Sun Fire Link Interconnect Networks Using Midframe Servers" at: http://www.sun.com/solutions/blueprints/0203/817-1656.pdf.
-
Follow the guidelines in [2] "Securing the Sun Fire™ 15K and 12K System Controllers" article at:
http://www.sun.com/solutions/blueprints/0203/817-1358.pdf. -
Configure the wcaa to use the Secure Sockets Layer (SSL).
-
Modify the FM keystore to include wcapp version 1.2 10/28/99.
The procedures for implementing these recommendations are located in the sections on "System Configuration" on page 7 and "Fabric Configuration" on page 19 following the Sun Fire Link hardware and software overviews.
Sun Fire Link Hardware Overview
The Sun Fire Link is a high-bandwidth, low-latency cluster interconnect used with Sun Fire™ 6800, Sun Fire 15K, and Sun Fire 12K servers to expand the high-end Sun Fire series system capabilities beyond the chassis. A Sun Fire Link cluster consists of up to eight Sun Fire 6800 and/or Sun Fire 15K and Sun Fire 12K nodes, connected to each other by a Sun Fire Link optical network. Each node has a separate instance of the Solaris OE running under a layer of clustering software, which can be either Sun™ Cluster software or Sun HPC ClusterTools™ software. This separate instance of the Solaris OE is also referred to as a domain. For some configurations, the interconnect hardware will include Sun Fire Link switches as well. A Sun Fire Link cluster also requires an Ethernet network to carry cluster administration traffic. This network connects all cluster components that exchange control and status or error information. A dedicated server to run the required management software is also recommended. The "Securing the Sun Fire Midframe System Controller" article discusses the midframe service processor (MSP). The MSP is a dedicated server that restricts access to the private System Controller (SC) network.
The Sun Cluster software and the Sun HPC ClusterTools software use the remote shared memory (RSM) interface for internode communication across a Sun Fire Link network. The RSM is a Sun messaging interface that is highly efficient for remote memory operations. For Sun Fire Link clusters of two or three nodes, the network connections can be either point to point (direct-connect topology) (FIGURE 1) or through Sun Fire Link switches (FIGURE 2). For larger clusters (four to eight nodes), a Sun Fire Link switch is required.
)
FIGURE 1
Direct-Connect Topology
The server's interface to the Sun Fire Link network is provided by a Sun Fire Link-specific I/O subsystem called the Sun Fire Link assembly. These assemblies are installed in standard server I/O slots. Each Sun Fire Link assembly contains two optical transceiver modules called Sun Fire Link optical modules. Each optical module supports a full-duplex optical link. The Sun Fire Link assemblies are installed in pairs to enhance availability and to support message striping for higher bandwidth.
)
FIGURE 2
Switched Topology