InfoScale™ 9.0 Cluster Server Administrator's Guide - AIX

Perform the following steps to manually configure the CP server in HTTPS-based mode to support IPv6 or dual stack:

1. Modify the /etc/vxcps.conf file to include the IPv6 address of the CP server.

   If the CP server should support pure IPv6 communication, remove the existing IPv4 entries and add the new IPv6 addresses in the configuration file. If the CP server should support IPv6 and IPv4 communications, add the IPv6 addresses along with the existing IPv4 addresses.

2. Generate the server certificate for the CP server to facilitate communication over the IPv6 channel along with IPv4.

   Perform these tasks sequentially:

   • If not already present, create an OpenSSL configuration file (https_ssl_cert.conf ) to add the new DNS.

   • Edit the https_ssl_cert.conf file to add DNS entries for the IPv4 and the IPv6 addresses.

     To support communication over pure IPv6 networks, remove the existing IPv4 entries from the file.

     For example:

     [req]
     distinguished_name = req_distinguished_name
     req_extensions = v3_req
     
     [req_distinguished_name]
     countryName = Country Name (2 letter code. eg, US)
     countryName_default = US
     localityName = Locality Name (eg, city)
     organizationalUnitName = Organizational Unit Name (eg, section)
     commonName = Common Name (eg, YOUR name)
     commonName_max = 64
     emailAddress = Email Address
     emailAddress_max = 40
     
     [v3_req]
     keyUsage = keyEncipherment, dataEncipherment
     extendedKeyUsage = serverAuth
     subjectAltName = @alt_names
     
     [alt_names]
     DNS.1 = cpsone.company.com
     DNS.2 = ipv6Address
     DNS.3 = ipv4Address

   • Recreate the server certificates by reusing the CA certificate, the server key, the newly created https_ssl_cert.conf file, and the cluster UUID.

     Note:

     The CA certificate and the server key are already present on the setup. Get the cluster UUID from the /etc/vx/.uuids/clusuuid file.

     # /opt/VRTSperl/non-perl-libs/bin/openssl req 
       -new -key /var/VRTScps/security/keys/server_private.key 
       -config https_ssl_cert.conf -subj 
       '/C=US/L=city/OU=section/CN={<UUID>}' 
       -out /var/VRTScps/security/certs/server.csr
     
     # /opt/VRTSperl/non-perl-libs/bin/openssl x509 -req -days 100 
       -in /var/VRTScps/security/certs/server.csr 
       -CA /var/VRTScps/security/certs/ca.crt 
       -CAkey /var/VRTScps/security/keys/ca.key 
       -set_serial 01 -extensions v3_req 
       -extfile https_ssl_cert.conf 
       -out /var/VRTScps/security/certs/server.crt
     

3. On the CP server, create a copy of the existing client certificates with the IPv4 addresses and rename the copy to include the IPv6 addresses in the certificate name.

   For example, if the IPv6 address is 2002::2 and the hostname is xyz:

   # cp /var/VRTSvxfen/security/certs/ca_xyz.crt 
     /var/VRTSvxfen/security/certs/ca_2002\:\:2.crt
   
   # cp /var/VRTSvxfen/security/certs/client_xyz.crt 
     /var/VRTSvxfen/security/certs/client_2002\:\:2.crt

4. On each client node, create a copy of the existing client certificates with the IPv4 addresses and rename the copy to include IPv6 addresses in the certificate name.

   For example, if the IPv4 address is 10.209.81.122 and IPv6 address is 2002::2:

   # cp /var/VRTSvxfen/security/certs/ca_10.209.81.122.crt 
     /var/VRTSvxfen/security/certs/ca_2002\:\:2.crt
   
   # cp /var/VRTSvxfen/security/certs/client_10.209.81.122.crt 
     /var/VRTSvxfen/security/certs/client_2002\:\:2.crt

5. Stop VCS on the CP server.

   # hastop -local

6. Update the main.cf file to include the newly added IPv6 resources, the quorum resource, and the dependencies for the newly added IPv6 resources.

   IP cpsvip2 
   ( 
   Critical = 0 
   Device @cps1 = eth1 
   Address = "ipv6Address" 
   PrefixLen = 64 
   )
   NIC cpsnic2 ( 
   Critical = 0 
   Device @cps1 = eth1 
   NetworkHosts @cps1 = {ipv6AddressOfNetworkHost}
              )
   
   Quorum quorum (
                   QuorumResources = { cpsvip1, cpsvip2 }
                   )
   
   cpsvip1 requires cpsnic1
   cpsvip2 requires cpsnic2
   vxcpserv requires quorum 
   

7. Restart the CP server.

   • To start VCS in a single-node cluster, run # hastart -onenode.

   • To start VCS in an SFHA cluster, run # hastart.

8. Perform the following tasks sequentially on each client node:

   • Create the /etc/vxfenmode.test file with the new IPv6 address of the CP server.

   • From any client node, start the vxfenswap utility.

   • Verify that fencing is running successfully on each node using the vxfenadm -d command.