Preparing customer firewalls and proxies for the upcoming infrastructure changes on IBM Electronic Fix Distribution / IBM Fix Central system

Risk classification

HIPER (High Impact and/or Pervasive)

Risk categories

Function Loss

Subcategories for Informational notifications

Download SW & Drivers

Affected Domain

Abstract

IBM completed the implementation of the infrastructure improvements to electronic fix distribution that started on June 4, 2022.

Public internet IP address and hostnames are changing for the IBM servers that support internet delivery of fixes and updates for customer system's software, hardware, and operating system.

This change pertains to all operating systems supported by IBM Electronic Fix Distribution (EFD) / IBM Fix Central system.

Customer action may be required to ensure uninterrupted fix delivery services.

Description

New network connections between your machine and IBM servers are required to keep your ability to order and download fixes and updates for your system's software, hardware, and operating system.

You must configure your firewall and proxy server if you have a firewall in your network, or if your machine must use a proxy server to access the internet.

Recommended Action

Firewall

Ensure as soon as possible that the following DNS names and ports are open on your firewall. If these connections are NOT currently allowed then you must create new firewall rules that allow them to flow - do NOT change or remove existing firewall rules at this point.

Note 1: IP addresses are subject to change. Use DNS names whenever possible.

Note 2: Existing connections to the legacy IBM servers should NOT be blocked because a separate communication will be sent when they are sunset. After that point in time you can remove obsolete firewall rules.

---

New Fix Ordering Hostname	External IP Address	Protocol	Port(s)
www-40.cpc.ibm.com	170.225.116.13	HTTPS	443
www-50.cpc.ibm.com	170.225.118.13	HTTPS	443
www-203.ibm.com	170.225.118.24	HTTPS	443
www-203.ibm.com	170.225.116.28	HTTPS	443

---

Existing Fix Download Hostname	New External IP Address	Protocol	Port(s)
delivery01-bld.dhe.ibm.com	170.225.126.67	SFTP	22
delivery01-bld.dhe.ibm.com	170.225.126.67	FTPS	20 + 21 + (65024 to 65535)
delivery01-mul.dhe.ibm.com	170.225.126.68	SFTP	22
delivery01-mul.dhe.ibm.com	170.225.126.68	FTPS	20 + 21 + (65024 to 65535)
delivery03.dhe.ibm.com	170.225.126.25	HTTPS	443
delivery03-bld.dhe.ibm.com	170.225.126.39	HTTPS	443
delivery03-mul.dhe.ibm.com	170.225.126.40	HTTPS	443
delivery04-bld.dhe.ibm.com	170.225.126.45	HTTP	80
delivery04-bld.dhe.ibm.com	170.225.126.45	HTTPS	443
delivery04-bld.dhe.ibm.com	170.225.126.45	SFTP	22
delivery04-bld.dhe.ibm.com	170.225.126.45	FTPS	20 + 21 + (65024 to 65535)
delivery04-mul.dhe.ibm.com	170.225.126.46	HTTP	80
delivery04-mul.dhe.ibm.com	170.225.126.46	HTTPS	443
delivery04-mul.dhe.ibm.com	170.225.126.46	SFTP	22
delivery04-mul.dhe.ibm.com	170.225.126.46	FTPS	20 + 21 + (65024 to 65535)
delivery04.dhe.ibm.com	170.225.126.44	HTTP	80
delivery04.dhe.ibm.com	170.225.126.44	HTTPS	443
delivery04.dhe.ibm.com	170.225.126.44	SFTP	22
delivery04.dhe.ibm.com	170.225.126.44	FTPS	20 + 21 + (65024 to 65535)
download2.boulder.ibm.com	170.225.126.42	HTTP	80
download2.boulder.ibm.com	170.225.126.42	HTTPS	443
download2.boulder.ibm.com	170.225.126.42	SFTP	22
download2.boulder.ibm.com	170.225.126.42	FTPS	20 + 21 + (65024 to 65535)
download3.boulder.ibm.com	170.225.126.24	HTTPS	443
download4.boulder.ibm.com	170.225.126.43	HTTP	80
download4.boulder.ibm.com	170.225.126.43	HTTPS	443
download4.boulder.ibm.com	170.225.126.43	SFTP	22
download4.boulder.ibm.com	170.225.126.43	FTPS	20 + 21 + (65024 to 65535)

---

Proxy server

If your machine does NOT have direct Internet access with your network configuration then you must make sure that your proxy server is correctly configured to allow these aforementioned connections to flow.

---

Questions & Answers

Q1) Am I impacted by this change ?

A1: The ability to download fixes from IBM may be impacted by this change under certain conditions such as:

• You are using Secure FTP protocols to download fixes such as SFTP or FTPS
• You are ordering fixes with dynamic content such as dynamic ISO images
• You are ordering newly published fixes or fixes that are under US export control restriction

• IBM Fix Central website
• IBM Installation Manager tool
• Hardware Management Console (HMC) appliance
• IBM i Send Program Temporary Fix Order (SNDPTFORD) command
• IBM ToolsCenter suite
• IBM Bootable Media Creator (BoMC) utility
• IBM UpdateXpress System Pack Installer utility
• IBM Systems Director
• IBM Electronic Service Agent
• IBM Tape Diagnostic Tool (ITDT)
• IBM TS3000 System Console (TSSC)

Date first published

05 May 2022

[{"Risk Classification":"HIPER","Line of Business":{"code":"LOB33","label":"N\/A"},"Business Unit":{"code":"BU051","label":"N\/A"},"Product":{"code":"SUPPORT","label":"IBM Worldwide Support"},"ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]