Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
Antes de instalar o Mainframe Connector, tem de fazer a configuração inicial, incluindo conceder as funções necessárias à sua conta de serviço, configurar a segurança dos seus recursos e configurar a conetividade de rede entre o mainframe e o Google Cloud. As secções seguintes descrevem cada tarefa detalhadamente.
Certifique-se de que as seguintes autorizações necessárias pela Java Cryptography Extension Common Cryptographic Architecture (IBMJCECCA) (Java 8 ou Java 17)
são concedidas para o seu mainframe. O protocolo Transport Layer Security (TLS) é usado em todos os pedidos feitos a partir do seu mainframe para as Google Cloud APIs. Se estas autorizações não forem concedidas, é apresentada uma mensagem de erro INSUFFICIENT ACCESS AUTHORITY.
ICSF Query Facility (CSFIQF)
Geração de números aleatórios criptograficamente seguros (CSFRNG)
Random Number Generate Long (CSFRNGL)
Importação de chaves PKA (CSFPKI)
Digital Signature Generate (CSFDSG)
Validação da assinatura digital (CSFDSV)
Configure a conetividade de rede
O Mainframe Connector interage com as APIs Cloud Storage, BigQuery e Cloud Logging. Certifique-se de que o Cloud Interconnect e os VPC Service Controls (VPC-SC) estão configurados para permitir o acesso a recursos específicos do BigQuery, Cloud Storage e Cloud Logging a partir de intervalos de IP especificados, com base na política da sua empresa. Também pode usar as APIs Pub/Sub, Dataflow e Dataproc para uma integração adicional entre tarefas em lote do IBM z/OS e pipelines de dados no Google Cloud.
Certifique-se de que a sua equipa de administração de rede tem acesso ao seguinte:
Sub-redes IP atribuídas às partições lógicas (LPARs) do IBM z/OS
Google Cloud Contas de serviço usadas por tarefas em lote do IBM z/OS
Google Cloud IDs de projetos que contêm recursos acedidos por trabalhos em lote do IBM z/OS
Configure firewalls, routers e sistemas de nomes de domínio
Configure os seus ficheiros IP de mainframe para incluir regras em firewalls, routers e
sistemas de nomes de domínio (DNSs) para permitir o tráfego de e para Google Cloud. Pode instalar userid.ETC.IPNODES ou userid.HOSTS.LOCAL como ficheiro de anfitriões para resolver os pontos finais da API Cloud Storage padrão como o ponto final do VPC-SC. O ficheiro de exemplo userid.TCPIP.DATA é implementado para configurar o DNS de modo a usar as entradas do ficheiro de anfitriões.
Para aplicar os VPC-SC na sua rede nas instalações, configure-os da seguinte forma:
Configure os routers no local para encaminhar o tráfego de saída do IBM z/OS para sub-redes de destino nas redes VPC e no domínio especial através do Cloud Interconnect ou de uma rede privada virtual (VPN).restricted.googleapis.com
Configure as firewalls no local para permitir o tráfego de saída para sub-redes da VPC ou instâncias de VMs e pontos finais da API Google: restricted.googleapis.com 199.36.153.4/30.
Configure as firewalls nas instalações para negar todo o outro tráfego de saída para evitar a circunvenção do VPC-SC.
Configure as firewalls no local para permitir o tráfego de saída para https://www.google-analytics.com.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-21 UTC."],[],[],null,["# Get started with Mainframe Connector\n\nBefore you install Mainframe Connector, you must perform the initial\nsetup, including granting the required roles to your service account, setting\nup security for your assets, and setting up network connectivity between your\nmainframe and Google Cloud. The following sections describe each task in detail.\n\nGrant service account permissions\n---------------------------------\n\nEnsure that the following roles are granted to your service account. You can\n[grant multiple roles to your service account using the Google Cloud console](/iam/docs/manage-access-service-accounts#multiple-roles-console) or\n[grant the roles programmatically](/iam/docs/manage-access-service-accounts#multiple-roles-programmatic).\n\n- At the project level, assign the following roles:\n - [Logs Writer](/iam/docs/understanding-roles#logging.logWriter)\n - [BigQuery Job User](/bigquery/docs/access-control#bigquery.jobUser)\n- On your Cloud Storage bucket, assign the following roles:\n - [Storage Object Admin](/storage/docs/access-control/iam-roles)\n - [BigQuery Data Editor](/bigquery/docs/access-control#bigquery.dataEditor)\n - [BigQuery Read Session User](/bigquery/docs/access-control#bigquery.readSessionUser)\n\nSet up security for your assets\n-------------------------------\n\nEnsure that the following permissions required by Java Cryptography Extension Common Cryptographic Architecture (IBMJCECCA) ([Java 8](https://www.ibm.com/docs/en/sdk-java-technology/8?topic=components-ibmjcecca) or [Java 17](https://www.ibm.com/docs/en/semeru-runtime-ce-z/17.0.0?topic=guide-ibmjcecca))\nare granted for your mainframe. Transport layer security (TLS) is used on all\nrequests made from your mainframe to Google Cloud APIs. If these permissions are\nnot granted, you will see an `INSUFFICIENT ACCESS AUTHORITY` error\nmessage.\n\n- ICSF Query Facility (CSFIQF)\n- Random Number Generate (CSFRNG)\n- Random Number Generate Long (CSFRNGL)\n- PKA Key Import (CSFPKI)\n- Digital Signature Generate (CSFDSG)\n- Digital Signature Verify (CSFDSV)\n\nSet up network connectivity\n---------------------------\n\nMainframe Connector interacts with Cloud Storage, BigQuery,\nand Cloud Logging APIs. Ensure [Cloud Interconnect](/network-connectivity/docs/interconnect)\nand [VPC Service Controls (VPC-SC)](/vpc-service-controls/docs/overview) is\nconfigured to allow access to specific BigQuery, Cloud Storage, and\nCloud Logging resources from specified IP ranges, based on your enterprise\npolicy. You can also use Pub/Sub, Dataflow, and Dataproc\nAPIs for additional integration between IBM z/OS batch jobs and data pipelines\non Google Cloud.\n\nEnsure that your network administration team has access to the following:\n\n- IP subnets assigned to the IBM z/OS logical partitions (LPARs)\n- Google Cloud service accounts used by IBM z/OS batch jobs\n- Google Cloud project IDs containing resources accessed by IBM z/OS batch jobs\n\nConfigure firewalls, routers, and Domain Name Systems\n-----------------------------------------------------\n\nConfigure your mainframe IP files to include rules in firewalls, routers, and\nDomain Name Systems (DNSs) to allow traffic to and from Google Cloud. You can\ninstall either *userid.ETC.IPNODES* or *userid.HOSTS.LOCAL* as\nhosts file to resolve the standard Cloud Storage API endpoints as the VPC-SC\nendpoint. The sample file *userid.TCPIP.DATA* is deployed to configure\nDNS to use the hosts file entries. \n\n - ETC.IPNODES\n - 199.36.153.4 www.googleapis.com\n - 199.36.153.5 www.googleapis.com\n - 199.36.153.6 www.googleapis.com\n - 199.36.153.7 www.googleapis.com\n - 199.36.153.4 oauth2.googleapis.com\n - 199.36.153.5 oauth2.googleapis.com\n - 199.36.153.6 oauth2.googleapis.com\n - 199.36.153.7 oauth2.googleapis.com\n - 127.0.0.1 LPAR1 (based on LPAR configuration)\n - 127.0.0.1 LPAR2\n - 127.0.0.1 LPAR3\n - HOSTS.LOCAL\n - HOST : 199.36.153.4, 199.36.153.5, 199.36.153.6, 199.36.153.7 : WWW.GOOGLEAPIS.COM ::::\n - HOST : 199.36.153.4, 199.36.153.5, 199.36.153.6, 199.36.153.7 : OAUTH2.GOOGLEAPIS.COM ::::\n - TCPIP.DATA\n - LOOKUP LOCAL DNS\n\n### Configure your network to enforce VPC-SC\n\nTo enforce VPC-SC on your on-premises network, configure it as follows:\n\n- Configure the on-premises routers to route IBM z/OS outbound traffic to destination subnets within the VPC networks and the `restricted.googleapis.com` special domain using Cloud Interconnect or a virtual private network (VPN).\n- Configure the on-premises firewalls to allow outbound traffic to VPC subnets or VM instances and Google API endpoints - `restricted.googleapis.com 199.36.153.4/30`.\n- Configure the on-premises firewalls to deny all other outbound traffic to prevent bypass of VPC-SC.\n- Configure the on-premises firewalls to allow outbound traffic to `https://www.google-analytics.com`.\n\nWhat's next\n-----------\n\n- [Install Mainframe Connector](/mainframe-connector/docs/installation)"]]
