Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Sebelum menginstal Mainframe Connector, Anda harus melakukan penyiapan awal, termasuk memberikan peran yang diperlukan ke akun layanan Anda, menyiapkan keamanan untuk aset Anda, dan menyiapkan konektivitas jaringan antara mainframe dan Google Cloud. Bagian berikut menjelaskan setiap tugas secara mendetail.
Pastikan izin berikut yang diperlukan oleh Java Cryptography Extension Common Cryptographic Architecture (IBMJCECCA) (Java 8 atau Java 17)
diberikan untuk mainframe Anda. Transport Layer Security (TLS) digunakan pada semua
permintaan yang dibuat dari mainframe Anda ke Google Cloud API. Jika izin ini tidak diberikan, Anda akan melihat pesan error INSUFFICIENT ACCESS AUTHORITY.
Fasilitas Kueri ICSF (CSFIQF)
Pembuatan Angka Acak (CSFRNG)
Random Number Generate Long (CSFRNGL)
Impor Kunci PKA (CSFPKI)
Pembuatan Tanda Tangan Digital (CSFDSG)
Verifikasi Tanda Tangan Digital (CSFDSV)
Menyiapkan konektivitas jaringan
Mainframe Connector berinteraksi dengan API Cloud Storage, BigQuery, dan Cloud Logging. Pastikan Cloud Interconnect
dan Kontrol Layanan VPC (VPC-SC) dikonfigurasi
untuk mengizinkan akses ke resource BigQuery, Cloud Storage, dan
Cloud Logging tertentu dari rentang IP yang ditentukan, berdasarkan kebijakan
perusahaan Anda. Anda juga dapat menggunakan API Pub/Sub, Dataflow, dan Dataproc
untuk integrasi tambahan antara tugas batch IBM z/OS dan pipeline data
di Google Cloud.
Pastikan tim administrasi jaringan Anda memiliki akses ke hal berikut:
Subnet IP yang ditetapkan ke partisi logis (LPAR) IBM z/OS
Google Cloud akun layanan yang digunakan oleh tugas batch IBM z/OS
ID projectGoogle Cloud yang berisi resource yang diakses oleh tugas batch IBM z/OS
Mengonfigurasi firewall, router, dan Sistem Nama Domain
Konfigurasi file IP mainframe Anda untuk menyertakan aturan di firewall, router, dan
Sistem Nama Domain (DNS) untuk mengizinkan traffic ke dan dari Google Cloud. Anda dapat
menginstal userid.ETC.IPNODES atau userid.HOSTS.LOCAL sebagai
file host untuk menyelesaikan endpoint Cloud Storage API standar sebagai endpoint VPC-SC. File contoh userid.TCPIP.DATA di-deploy untuk mengonfigurasi DNS agar menggunakan entri file host.
Mengonfigurasi jaringan Anda untuk menerapkan VPC-SC
Untuk menerapkan VPC-SC di jaringan lokal Anda, konfigurasikan sebagai berikut:
Konfigurasi router lokal untuk merutekan traffic keluar IBM z/OS ke
subnet tujuan dalam jaringan VPC dan domain khusus restricted.googleapis.com
menggunakan Cloud Interconnect atau virtual private network (VPN).
Konfigurasi firewall lokal untuk mengizinkan traffic keluar ke subnet VPC atau instance VM dan endpoint Google API - restricted.googleapis.com 199.36.153.4/30.
Konfigurasi firewall lokal untuk menolak semua traffic keluar lainnya guna mencegah pengabaian VPC-SC.
Konfigurasi firewall lokal untuk mengizinkan traffic keluar ke https://www.google-analytics.com.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-19 UTC."],[],[],null,["# Get started with Mainframe Connector\n\nBefore you install Mainframe Connector, you must perform the initial\nsetup, including granting the required roles to your service account, setting\nup security for your assets, and setting up network connectivity between your\nmainframe and Google Cloud. The following sections describe each task in detail.\n\nGrant service account permissions\n---------------------------------\n\nEnsure that the following roles are granted to your service account. You can\n[grant multiple roles to your service account using the Google Cloud console](/iam/docs/manage-access-service-accounts#multiple-roles-console) or\n[grant the roles programmatically](/iam/docs/manage-access-service-accounts#multiple-roles-programmatic).\n\n- At the project level, assign the following roles:\n - [Logs Writer](/iam/docs/understanding-roles#logging.logWriter)\n - [BigQuery Job User](/bigquery/docs/access-control#bigquery.jobUser)\n- On your Cloud Storage bucket, assign the following roles:\n - [Storage Object Admin](/storage/docs/access-control/iam-roles)\n - [BigQuery Data Editor](/bigquery/docs/access-control#bigquery.dataEditor)\n - [BigQuery Read Session User](/bigquery/docs/access-control#bigquery.readSessionUser)\n\nSet up security for your assets\n-------------------------------\n\nEnsure that the following permissions required by Java Cryptography Extension Common Cryptographic Architecture (IBMJCECCA) ([Java 8](https://www.ibm.com/docs/en/sdk-java-technology/8?topic=components-ibmjcecca) or [Java 17](https://www.ibm.com/docs/en/semeru-runtime-ce-z/17.0.0?topic=guide-ibmjcecca))\nare granted for your mainframe. Transport layer security (TLS) is used on all\nrequests made from your mainframe to Google Cloud APIs. If these permissions are\nnot granted, you will see an `INSUFFICIENT ACCESS AUTHORITY` error\nmessage.\n\n- ICSF Query Facility (CSFIQF)\n- Random Number Generate (CSFRNG)\n- Random Number Generate Long (CSFRNGL)\n- PKA Key Import (CSFPKI)\n- Digital Signature Generate (CSFDSG)\n- Digital Signature Verify (CSFDSV)\n\nSet up network connectivity\n---------------------------\n\nMainframe Connector interacts with Cloud Storage, BigQuery,\nand Cloud Logging APIs. Ensure [Cloud Interconnect](/network-connectivity/docs/interconnect)\nand [VPC Service Controls (VPC-SC)](/vpc-service-controls/docs/overview) is\nconfigured to allow access to specific BigQuery, Cloud Storage, and\nCloud Logging resources from specified IP ranges, based on your enterprise\npolicy. You can also use Pub/Sub, Dataflow, and Dataproc\nAPIs for additional integration between IBM z/OS batch jobs and data pipelines\non Google Cloud.\n\nEnsure that your network administration team has access to the following:\n\n- IP subnets assigned to the IBM z/OS logical partitions (LPARs)\n- Google Cloud service accounts used by IBM z/OS batch jobs\n- Google Cloud project IDs containing resources accessed by IBM z/OS batch jobs\n\nConfigure firewalls, routers, and Domain Name Systems\n-----------------------------------------------------\n\nConfigure your mainframe IP files to include rules in firewalls, routers, and\nDomain Name Systems (DNSs) to allow traffic to and from Google Cloud. You can\ninstall either *userid.ETC.IPNODES* or *userid.HOSTS.LOCAL* as\nhosts file to resolve the standard Cloud Storage API endpoints as the VPC-SC\nendpoint. The sample file *userid.TCPIP.DATA* is deployed to configure\nDNS to use the hosts file entries. \n\n - ETC.IPNODES\n - 199.36.153.4 www.googleapis.com\n - 199.36.153.5 www.googleapis.com\n - 199.36.153.6 www.googleapis.com\n - 199.36.153.7 www.googleapis.com\n - 199.36.153.4 oauth2.googleapis.com\n - 199.36.153.5 oauth2.googleapis.com\n - 199.36.153.6 oauth2.googleapis.com\n - 199.36.153.7 oauth2.googleapis.com\n - 127.0.0.1 LPAR1 (based on LPAR configuration)\n - 127.0.0.1 LPAR2\n - 127.0.0.1 LPAR3\n - HOSTS.LOCAL\n - HOST : 199.36.153.4, 199.36.153.5, 199.36.153.6, 199.36.153.7 : WWW.GOOGLEAPIS.COM ::::\n - HOST : 199.36.153.4, 199.36.153.5, 199.36.153.6, 199.36.153.7 : OAUTH2.GOOGLEAPIS.COM ::::\n - TCPIP.DATA\n - LOOKUP LOCAL DNS\n\n### Configure your network to enforce VPC-SC\n\nTo enforce VPC-SC on your on-premises network, configure it as follows:\n\n- Configure the on-premises routers to route IBM z/OS outbound traffic to destination subnets within the VPC networks and the `restricted.googleapis.com` special domain using Cloud Interconnect or a virtual private network (VPN).\n- Configure the on-premises firewalls to allow outbound traffic to VPC subnets or VM instances and Google API endpoints - `restricted.googleapis.com 199.36.153.4/30`.\n- Configure the on-premises firewalls to deny all other outbound traffic to prevent bypass of VPC-SC.\n- Configure the on-premises firewalls to allow outbound traffic to `https://www.google-analytics.com`.\n\nWhat's next\n-----------\n\n- [Install Mainframe Connector](/mainframe-connector/docs/installation)"]]
