IBM IMPACT 2014 presentation Dutch Tax and Customs Administration is one of the largest PureApplication System clients world wide. Over the past year they moved a number of workloads into production, including WAS 8.0 JEE applications, BPM v8.0.1 and a stack of Information Management middleware. In this session we will focus on the pattern customisation efforts required for production workloads. This includes integration with TWS, TSM, NFS and Active Directory. We will also look at other customisation aspects such as automatic firewall and timezone configuration. Last but not least we will share a number of best practices established by IBM and the client while working with PureApplication System over the past year and a half.

1. Bringing workloads into
production on
PureApplication System
IBM IMPACT 2014 Conference
Session 1445
Robin Strijk – r.strijk@belastingdienst.nl
IT-architect,
Dutch Tax and Customs administration
Hendrik van Run – hvanrun@uk.ibm.com
Consulting IT specialist, IBM
25 april 2014

2. Agenda
1. Who is Dutch Tax?
2. System setup
3. Workloads
4. Pattern Customization
5. Best practices
25 april 2014

3. Who are the Dutch?
25 April 2014

4. Who is Dutch Tax and Customs administration
25 April 2014
29.000 employees
Serving 11 mio citizens
Serving 1 mio companies
€ 232 billion in taxes
€ 12 billion in benefits
12 mio shipping containers
to pass the Port of
Rotterdam each year
2.2 mio fiscal
investigations
14 mio calls
2000 ICT staff

5. Our IT landscape
25 April 2014
250 x86 systems
± 2,000 vm’s
(Linux/Windows)
176 Unix systems,
± 2,300 vm’s (AIX)
4 PB Storage
2 mainframes
2,500 MSU
1,900
2,500
19,000
30,000
4 PureApplication
Systems

6. NOV DEC JAN FEB MAR APR MAY JUN JUL AUG SEP OCT NOV DEC
2012 2013
JAN FEB MAR APR
2014
On-site
Proof-of-
Concept
Setup of 4
systems
Firmware
upgrade to
1.0.0.4
Version
upgrade to
1.1.0.0 Firmware
upgrade to
1.1.0.1
Firmware
upgrade to
1.1.0.2
Upgrade to
Medium
systems
IM Middleware for “Master Information Hub” project
BPM 8.0 for “LIC” project
WAS 8.0 for “Appeon” project
Integration of PureApplication System within the Enterprise
System Design
and Configuration
BPM 8.5 project
Pure
Experience
Firmware
upgrade to
1.0.0.3
“Appeon” apps to production
Preparing for redesign
-- ongoing --
Java EE Hosting project
v7000
consolidation

7. System Setup
25 April 2014

8. Hardware setup
25 April 2014
Datacenter 1 Datacenter 2
pure01
pure03
pure02
pure04
PurePlex
PurePlex
Systems:
 W1500 (intel)
 Medium size
12 compute nodes
192 Intel Xeon cores
3,072 GB RAM
 Identical setup
System settings
Cloud Groups
IP Groups
Environment Profiles
Network:
 6x fiber/10Gb

9. Network setup
25 April 2014
IBM PureApplication System “pure01”
Top of Rack Switch (IBM BNT G8264)
devVLAN(O-01)
backupVLAN(BNR)
testVLAN(T-01)
Top of Rack Switch (IBM BNT G8264)
development
Virtual Machine
test
Virtual Machine
eth1 eth2 eth2 eth1

10. Workload dev.Workload dev.
Workload dev.Workload dev.
Workload dev.Workload dev.
Workload dev.Workload dev.
Cloud Group setup
25 April 2014
Lab
250 IP’s, dev.
10 IP’s BnR
Test
750 IP’s, dev.
1000 IP’s test
1000 IP’s QA.
160 IP’s BnR
Production
1000 IP’s production
80 IP’s BnR
Cloud & IP Groups Environment Profiles
Shared Service Lab
IPAS operations
Workload dev.
Workload test
Workload QA.
Shared Service Test
Workload production
Shared Service Prod.

11. EIF
SNMP
Monitoring setup
25 April 2014
IPAS
(events)
IPAS Monitoring backend
Netcool
Omnibus
SNMP trap
receiver
HP Openview
Workload
agents
Workload
agents
Workload
agents
Shared
monitoring
service
Shared
monitoring
service
Shared
monitoring
service
IPAS
agent
Workload
agents
Workload
agents
Workload
agents

12. Workloads
25 April 2014

13. Appeon
Business drive:
• PB/SB migrated before
8 april 2014 (Windows XP).
• Java migration too slow
• Appeon for transition
Results using IPAS:
• Self-service test environment
2 months (Feb-Mar)
• QA & Production
5 months (Feb-Jun)
25 April 2014
Requirements:
• WAS 8.0
• Stateless
• 6 months
(traditional takes 9 months)
Drawbacks:
• Speed of delivery raised
business expectations
• No monitoring

14. Appeon
25 April 2014
Appeon Production TopologyAppeon Test Environment Topology

15. Master Information Hub
Business drive:
• Single view of Citizen
• Web Service
Results using IPAS :
• MIH dev & test environment
2 months (April-May)
• MIH production
7 months (April-Oct)
• MIH production HA
10 months (April-Jan)
25 April 2014
Requirements:
• Master Data Management 10.1
• Infosphere Information
Server 9.1
• Data Size, 2+ TB
• 24x7
• 6 months
Drawbacks:
• Speed of delivery raised
business expectations
• Security policy issues
• IPAS storage limited
• Custom monitoring solution

16. pure03
PureApplication System W1500
z/OS distributed sysplex
DB2 10.1
pure04
PureApplication System W1500
pure03
PureApplication System W1500
Pattern Instance Pattern Instance
MDM_CN2 VM
MIH MDM 10.1
Virtual System
Pattern
deploy
MDM_CN1 VM
MDM_DMGR VM
MDM_CN2 VM MDM_CN1 VM
MDM_DMGR VM
deploy
Pattern Instance Pattern Instance
MIH NFS Server
Virtual System
Pattern
deploy
NFS VMNFS VM
deploy
Pattern Instance Pattern Instance
MIH IIS 9.1 and CDC
6.5.2.0
Virtual System
Pattern
deploy
IIS_CN VMIIS_EN VMIIS_EN VMIIS_CN VM
deploy
Load Balancer
MDMCM1
MDM Configuration Management
Service Integration Bus
MDMCM1
MDM Configuration Management
Service Integration Bus
MDMCM1
MDM Configuration Management
Service Integration Bus
MDMCM1
MDM Configuration Management
Service Integration Bus
MDM
MDM Database
MDM
MDM Database
IBM Tivoli Workload Scheduler
inbound web services requests
MDM DMGR VM
IIS Enterprise Node VMIIS Compute Node VM
NFS VM
MDM Custom node 1 VM
TWSTSM
MDM Custom Node 2 VM
TWSTSM
TWSTSM
MDM Batch Processor
CDC subscriptions
z/OS distributed sysplex
IBM Tivoli Workload Scheduler
· Orchestrates backups across
multiple VMs
· Calls TSM client from
commandline
· Stops and starts services as
required
· Orchestrates the starting of
services in case of failover
AIX LPAR
IBM Tivoli Storage Manager
· One node defined for each
VM that runs the TSM client
· TSM backups are made from
the TSM client
· TSM scheduled is hence not
used
Master Information Hub Infrastructure
25 April 2014

17. BPM / WAB / LIC
Business drive:
• Centralize debt collection
• Single way of working
• Showcase BPM capability
Results using IPAS :
• BPM dev & test environment
1 month (July)
• BPM QA & Production
2 months (July-August)
25 April 2014
Requirements:
• Business Process Manager 8.0
• Process Center & Server
• ECM integration
• 2 months
(traditional takes 12 months)
Drawbacks:
• Speed of delivery raised
business expectations
• Manual backup / no monitoring
• BPM/LIC production crash in
November
• License model BPM

18. BPM / LIC
25 April 2014
BPM 8.0 Process Server Pattern topologyLIC / WAB Context Diagram

19. Pattern Customization
25 April 2014

20. Do you need Pattern Customization?
25 April 201425 April 2014
Custom component
IBM component

21. Script Package – add login banner v1.0
• Very simple Script Package to present a legal banner
• Can be applied to any deployed Virtual Machine
• Configures SSHD to show the banner upon logon
25 April 2014

22. Script Package – configure time zone v1.2
How to configure local timezone?
• Write a custom Script Package
to set the timezone
• Include Script Package in all
patterns
PureApplication System 1.1.0.2+
• Configure timezone from
Environment Profile
• No Pattern Customization
required!
25 April 2014

23. Script Package – configure inbound firewall v1.2
• Implementation of Script Package that configures iptables firewall
• Applies a default configuration to iptables
• Ensures that the service iptables is started
• Configures appropriate runlevels for the service
• Comma-separated lists are used to define the ports to be opened
• Source address can be included as well
– 2049,31114
– ${Enterprise_IBM_InformationServer_912.hostname}.${Enterprise_
IBM_InformationServer_912.domain}:10240-
• Firewall configuration is
easily configurable and
now consistent across
Virtual System Images
25 April 2014

24. Add-on – add LVM disk v1.1
25 April 2014
• Implementation of a disk add-on that leverages the Logical Volume
Manager
• Similar to default “add disk” add-on provided out-of-the-box
• An LVM volume is created on top of the raw volume
• The file system is created on the LVM volume
• Benefit is that the file system
can easily be increased in size
1. Add a new storage volume
to the Virtual Machine
2. Add the new raw volume to
the existing LVM volume

25. Add-on – add BNR NIC v1.0
25 April 2014
• Implementation of a NIC add-on that updates the routing table
• Similar to default “add NIC” add-on provided out-of-the-box
• Used for any VM connecting to the Backup Network (BNR)
• A network route is setup for the NIC using a known gateway
• Two parameters need to be defined for this add-on
• BNR_NETWORK_CIDR defines the network
• BNR_GATEWAY defines the gateway for that network
• Benefit is that the new NIC
can be used straightaway!
• No need for configuration
post-deployment

26. Script Package – install TWS v1.4
25 April 2014

27. Script Package – create TSM configuration v1.1
25 April 2014

28. Script Package – create NFS client/server v1.5
25 April 2014
MDM DMGR VM
/opt/mih/StagingOut
IIS Enterprise Node VM
/opt/mih/StagingOut
IIS Compute Node VM
/stagingout
NFS VM
/opt/mih/BatchLoadIn
MDM Custom node VM
NFS
client
/opt/mih/BatchLoadIn
MDM Custom Node VM
NFS
client
NFS
server
NFS
client
NFS
client
Script Packages are configured to run after deployment
• “When I initiate it”
Script Packages are run in order
1. create NFS server v1.5
2. create NFS client v1.5

29. Script Packages – Active Directory Integration
• “install AD OS
integration rpms v1.2”
• Installs required
RPMs at deployment
time
• “add AD OS
integration v1.3”
• Joins AD domain at
deployment time
• “remove AD OS
integration v1.1”
• Leaves AD domain at
deletion time
25 April 2014
IBM PureApplication System
Virtual System Pattern
Virtual System Instance
Deploy
3
Virtual
Machine
1
Delete
Virtual System Instance
Virtual
Machine
Red Hat OS
hosta.domain
Microsoft Active Directory (.domain)
2
Leave
Join
Red Hat OS
hosta.domain
4
Container
ComputerObject for hosta
ComputerObject for hostb
ComputerObject for hostc

30. install AD OS integration rpms v1.2
• Performs installation of RedHat packages required for integration
with Active Directory
• samba-3.6.9-151.el6.x86_64.rpm
• samba-client-3.6.9-151.el6.x86_64.rpm
• samba-common-3.6.9-151.el6.x86_64.rpm
• samba-winbind-3.6.9-151.el6.x86_64.rpm
• samba-winbind-clients-3.6.9-151.el6.x86_64.rpm
• Exact implementation varies
depending on the Virtual System
Image (.ova) used
• Longer term the use of the RedHat
OS Update Service will be used
25 April 2014

31. add AD OS integration v1.3
• Configures RedHat to integrate with Active Directory
• Authentication
• Group membership
• Single Sign-On
using Kerberos
• Joins the Active Directory
domain
• Creates computerObject
in AD container
• Establishes trust for Single
Sign-On
25 April 2014

32. remove AD OS integration v1.1
• Leaves the Active Directory
domain
• Removes computerObject
from AD container
• Executes at virtual system
deletion time
25 April 2014

33. Demonstrating Integration with Active Directory
25 April 2014
Logging on as “run0h00”
which is a member of the
group “ipasmiddleware” and
can therefore perform a sudo
to “virtuser”.
Logging on as “run0h00” using
password authentication on
“on01p015”. From there the
user can perform a Single-Sign
On to “on01p013” which is in
the same domain.

34. Best Practices
25 April 2014

35. Versioning and pattern customization
Information Management patterns had to be extensively customized
• Integration within the enterprise landscape can be complex
• Strong need for versioning of patterns and all related artefacts!
25 April 2014
Consistent deployments require locking of
• Virtual System Pattern
• Script Packages
• Add-ons
The above best practices are applicable to
all Virtual System Patterns

36. IBM PureApplication System Upgrades
25 April 2014

37. Collaborate with IBM to make IPAS platform a success!
• Detailed planning to ensure smooth firmware upgrades
• On-site support to quickly address hardware failures
• Work extensively with IBM support, services and lab advocate
– Speed up resolution of urgent PMRs
– Many PMRs raised to drive improvement of the product
– Drive product enhancements
> Using the Request for Enhancement process
Don’t be afraid to get wet feet!
Collaboration
25 April 2014

38. Links
Recommended: The Netherlands / Holland / The Dutch
http://www.youtube.com/watch?v=eE_IUPInEuc
IBM PureSystems Centre
https://www-304.ibm.com/software/brandcatalog/puresystems/centre/
IBM RFE Community
https://www.ibm.com/developerworks/rfe/
The European Pure User Group
http://europeanpureusergroup.com/
25 April 2014

39. Thank You!
25 April 2014