Mantieni tutto organizzato con le raccolte
Salva e classifica i contenuti in base alle tue preferenze.
Prima di installare Mainframe Connector, devi eseguire la configurazione iniziale, inclusa la concessione dei ruoli richiesti al tuo account di servizio, la configurazione della sicurezza per i tuoi asset e la configurazione della connettività di rete tra il tuo mainframe e Google Cloud. Le sezioni seguenti descrivono in dettaglio ogni attività.
Assicurati che le seguenti autorizzazioni richieste da Java Cryptography Extension Common Cryptographic Architecture (IBMJCECCA) (Java 8 o Java 17)
siano concesse per il tuo mainframe. TLS (Transport Layer Security) viene utilizzato in tutte le
richieste effettuate dal mainframe alle API Google Cloud . Se queste autorizzazioni non vengono concesse, visualizzerai un messaggio di errore INSUFFICIENT ACCESS AUTHORITY.
ICSF Query Facility (CSFIQF)
Genera numero casuale (CSFRNG)
Genera numero casuale lungo (CSFRNGL)
Importazione chiave PKA (CSFPKI)
Genera firma digitale (CSFDSG)
Digital Signature Verify (CSFDSV)
Configurare la connettività di rete
Mainframe Connector interagisce con le API Cloud Storage, BigQuery e Cloud Logging. Assicurati che Cloud Interconnect e Controlli di servizio VPC (VPC-SC) siano configurati per consentire l'accesso a risorse specifiche di BigQuery, Cloud Storage e Cloud Logging da intervalli IP specifici, in base alle norme aziendali. Puoi anche utilizzare le API Pub/Sub, Dataflow e Dataproc
per un'ulteriore integrazione tra i job batch IBM z/OS e le pipeline di dati
su Google Cloud.
Assicurati che il team di amministrazione di rete abbia accesso a quanto segue:
Subnet IP assegnate alle partizioni logiche (LPAR) IBM z/OS
Google Cloud service account utilizzati dai job batch IBM z/OS
Google Cloud ID progetto contenenti le risorse a cui accedono i job batch IBM z/OS
Configurare firewall, router e sistemi di nomi di dominio
Configura i file IP del mainframe in modo da includere regole in firewall, router e
Domain Name System (DNS) per consentire il traffico da e verso Google Cloud. Puoi installare userid.ETC.IPNODES o userid.HOSTS.LOCAL come file hosts per risolvere gli endpoint API Cloud Storage standard come endpoint VPC-SC. Il file di esempio userid.TCPIP.DATA viene implementato per configurare
il DNS in modo che utilizzi le voci del file hosts.
Per applicare VPC-SC alla tua rete on-premise, configurala nel seguente modo:
Configura i router on-premise per instradare il traffico in uscita di IBM z/OS verso le subnet di destinazione all'interno delle reti VPC e il dominio speciale restricted.googleapis.com utilizzando Cloud Interconnect o una rete privata virtuale (VPN).
Configura i firewall on-premise per consentire il traffico in uscita verso le subnet VPC
o le istanze VM e gli endpoint API di Google - restricted.googleapis.com 199.36.153.4/30.
Configura i firewall on-premise in modo da negare tutto il traffico in uscita per
impedire l'aggiramento di VPC-SC.
Configura i firewall on-premise per consentire il traffico in uscita verso https://www.google-analytics.com.
[[["Facile da capire","easyToUnderstand","thumb-up"],["Il problema è stato risolto","solvedMyProblem","thumb-up"],["Altra","otherUp","thumb-up"]],[["Difficile da capire","hardToUnderstand","thumb-down"],["Informazioni o codice di esempio errati","incorrectInformationOrSampleCode","thumb-down"],["Mancano le informazioni o gli esempi di cui ho bisogno","missingTheInformationSamplesINeed","thumb-down"],["Problema di traduzione","translationIssue","thumb-down"],["Altra","otherDown","thumb-down"]],["Ultimo aggiornamento 2025-09-11 UTC."],[],[],null,["# Get started with Mainframe Connector\n\nBefore you install Mainframe Connector, you must perform the initial\nsetup, including granting the required roles to your service account, setting\nup security for your assets, and setting up network connectivity between your\nmainframe and Google Cloud. The following sections describe each task in detail.\n\nGrant service account permissions\n---------------------------------\n\nEnsure that the following roles are granted to your service account. You can\n[grant multiple roles to your service account using the Google Cloud console](/iam/docs/manage-access-service-accounts#multiple-roles-console) or\n[grant the roles programmatically](/iam/docs/manage-access-service-accounts#multiple-roles-programmatic).\n\n- At the project level, assign the following roles:\n - [Logs Writer](/iam/docs/understanding-roles#logging.logWriter)\n - [BigQuery Job User](/bigquery/docs/access-control#bigquery.jobUser)\n- On your Cloud Storage bucket, assign the following roles:\n - [Storage Object Admin](/storage/docs/access-control/iam-roles)\n - [BigQuery Data Editor](/bigquery/docs/access-control#bigquery.dataEditor)\n - [BigQuery Read Session User](/bigquery/docs/access-control#bigquery.readSessionUser)\n\nSet up security for your assets\n-------------------------------\n\nEnsure that the following permissions required by Java Cryptography Extension Common Cryptographic Architecture (IBMJCECCA) ([Java 8](https://www.ibm.com/docs/en/sdk-java-technology/8?topic=components-ibmjcecca) or [Java 17](https://www.ibm.com/docs/en/semeru-runtime-ce-z/17.0.0?topic=guide-ibmjcecca))\nare granted for your mainframe. Transport layer security (TLS) is used on all\nrequests made from your mainframe to Google Cloud APIs. If these permissions are\nnot granted, you will see an `INSUFFICIENT ACCESS AUTHORITY` error\nmessage.\n\n- ICSF Query Facility (CSFIQF)\n- Random Number Generate (CSFRNG)\n- Random Number Generate Long (CSFRNGL)\n- PKA Key Import (CSFPKI)\n- Digital Signature Generate (CSFDSG)\n- Digital Signature Verify (CSFDSV)\n\nSet up network connectivity\n---------------------------\n\nMainframe Connector interacts with Cloud Storage, BigQuery,\nand Cloud Logging APIs. Ensure [Cloud Interconnect](/network-connectivity/docs/interconnect)\nand [VPC Service Controls (VPC-SC)](/vpc-service-controls/docs/overview) is\nconfigured to allow access to specific BigQuery, Cloud Storage, and\nCloud Logging resources from specified IP ranges, based on your enterprise\npolicy. You can also use Pub/Sub, Dataflow, and Dataproc\nAPIs for additional integration between IBM z/OS batch jobs and data pipelines\non Google Cloud.\n\nEnsure that your network administration team has access to the following:\n\n- IP subnets assigned to the IBM z/OS logical partitions (LPARs)\n- Google Cloud service accounts used by IBM z/OS batch jobs\n- Google Cloud project IDs containing resources accessed by IBM z/OS batch jobs\n\nConfigure firewalls, routers, and Domain Name Systems\n-----------------------------------------------------\n\nConfigure your mainframe IP files to include rules in firewalls, routers, and\nDomain Name Systems (DNSs) to allow traffic to and from Google Cloud. You can\ninstall either *userid.ETC.IPNODES* or *userid.HOSTS.LOCAL* as\nhosts file to resolve the standard Cloud Storage API endpoints as the VPC-SC\nendpoint. The sample file *userid.TCPIP.DATA* is deployed to configure\nDNS to use the hosts file entries. \n\n - ETC.IPNODES\n - 199.36.153.4 www.googleapis.com\n - 199.36.153.5 www.googleapis.com\n - 199.36.153.6 www.googleapis.com\n - 199.36.153.7 www.googleapis.com\n - 199.36.153.4 oauth2.googleapis.com\n - 199.36.153.5 oauth2.googleapis.com\n - 199.36.153.6 oauth2.googleapis.com\n - 199.36.153.7 oauth2.googleapis.com\n - 127.0.0.1 LPAR1 (based on LPAR configuration)\n - 127.0.0.1 LPAR2\n - 127.0.0.1 LPAR3\n - HOSTS.LOCAL\n - HOST : 199.36.153.4, 199.36.153.5, 199.36.153.6, 199.36.153.7 : WWW.GOOGLEAPIS.COM ::::\n - HOST : 199.36.153.4, 199.36.153.5, 199.36.153.6, 199.36.153.7 : OAUTH2.GOOGLEAPIS.COM ::::\n - TCPIP.DATA\n - LOOKUP LOCAL DNS\n\n### Configure your network to enforce VPC-SC\n\nTo enforce VPC-SC on your on-premises network, configure it as follows:\n\n- Configure the on-premises routers to route IBM z/OS outbound traffic to destination subnets within the VPC networks and the `restricted.googleapis.com` special domain using Cloud Interconnect or a virtual private network (VPN).\n- Configure the on-premises firewalls to allow outbound traffic to VPC subnets or VM instances and Google API endpoints - `restricted.googleapis.com 199.36.153.4/30`.\n- Configure the on-premises firewalls to deny all other outbound traffic to prevent bypass of VPC-SC.\n- Configure the on-premises firewalls to allow outbound traffic to `https://www.google-analytics.com`.\n\nWhat's next\n-----------\n\n- [Install Mainframe Connector](/mainframe-connector/docs/installation)"]]
