Filter
Top Products
Chapter 2. Implementation planning 81
This section provides some examples of the implementation planning that can be
implemented for that particular scenario. It is meant to help systems
administrators to understand the different solutions for using IBM Tivoli Remote
Control across firewalls. However, it does not provide all details needed for a
complete implementation. Complete details and more realistic implementations
will be provided in Chapter 3, “Implementation scenario: Standalone Proxies” on
page 93 and Chapter 4, “Implementation scenario: Tivoli Firewall Security
Too l box ” on page 115. Additional information can also be found in the
IBM Tivoli
Remote Control User’s Guide
, SC23-4842 and in 1.2, “IBM Tivoli Remote Control
sessions overview” on page 12.
Implementation planning case study overview
This case scenario provides a fictitious example of an Enterprise, named CSI
Corporation, who decided to outsource its first and second level support, for both
workstations and servers, to IBM Switzerland.
In fact, some Endpoint parts of the Tivoli Management Region of the CSI
Corporation are installed in the IBM office, which is linked to the customer site
with a 128 MB WAN access. These Endpoints will act as the Controllers.
However, as these Endpoints in the IBM site are located in the External network
zone, and their respective Tivoli Endpoint Gateways are located in the Internal
zone, a connection from the Endpoints to their Tivoli Endpoint Gateway must
cross a DMZ to be completed. For this reason, the following components have to
be installed:
A Gateway Proxy in the External zone
A second instance of the Relay in the DMZ
An Endpoint Proxy connected to a dedicated Tivoli Gateway for IBM
Endpoints, in the Internal zone.
All workstations of the customer are placed in the Internal network zone. The
Security Officer of the CSI Corporation has defined a secure network zone inside
the enterprise to protect most of the enterprise servers. In this case, all IBM
Switzerland Administrators thus need to have Remote Control access to both the
Internal and the Servers network zones.
Furthermore, in order to maximize security, the Security Officer has decided on
the following communication types:
Bidirectional between the Endpoint Proxy and the Relay — that is, between
the Internal network zone and the DMZ
Restricted to unidirectional between the Relay and the Gateway Proxy — that
is, between the DMZ and the External network zone