To all PA Cloud customers:
You should have recently received a correspondence from IBM (“IBM Planning Analytics -- Important Action Required -- Planned Secure Gateway Outage”) with regard to IBM reconfiguring the connections for the Secure Gateway component of Planning Analytics on Cloud, (PA Cloud). The purpose of this message is to provide some context for the notice. The IBM correspondence is included at the end of this message for your convenience.
This component is responsible for providing a secure connection between an on-premises relational database like a data warehouse or general ledger system and PA Cloud servers. This connection is a secure tunnel between an IBM Secure Gateway Agent piece of software that is running on-premises that maintains a connection between your source database and an IBM Cloud based Secure Gateway server.
The internet addresses of those IBM Secure Gateway servers in the IBM Cloud are changing.
The IBM updates should not be an issue unless the on-premises server where the IBM Secure Gateway Agent service is running has been firewall constrained to limit all outbound connections to specific IBM Cloud servers. IBM is changing some IP addresses, some fully qualified domain names of the cloud-based servers, and in some cases even the domain from “ibmcloud.com” to “ibm.com”. As a result, if corporate firewall whitelisting exists for outbound connections, it will need to be updated to accommodate the changes.
IMPORTANT: If you are affected, your IBM PA Cloud server will lose connectivity to data sources accessed via the IBM Secure Gateway until your firewall has been updated as explained below.
To find out if the change at 11:00pm EST on April 13th impacts you, check your configured data sources in PA Cloud Administration/Secure Gateway as explained in the IBM email. Opening an existing data source will reveal the Secure Gateway “Cloud host” that your PA Cloud tenant is using. The example below has “sg-wdc-01.integration.ibmcloud.com” and, per the IBM email, we know it will be impacted.
For example, for some North American clients that have their Secure Gateway at:
- sgmanagertm1.integration.ibmcloud.com or
- sg-wdc-*.integration.ibmcloud.com
They will be changing to:
- sgmanagertm1.integration.ibmcloud.com (208.43.117.195) or
- tm1-wdc-sgmanager-lb-285900-wdc01.clb.appdomain.cloud.ibm.com (158.85.15.77 and 198.11.253.116) NEW
From reading the IBM message, it may be safer to verify both target addresses since the current servers are being re-aligned. In either case, outbound connections on port 443 need to be allowed for continued access from PA Cloud to on-premises ODBC databases.
QueBIT Consulting is always here to help, let us know if we can. You can reach us at support@quebit.com.
This email is to provide you important notice of Secure Gateway maintenance being planned by the IBM Cloud Secure Gateway team.
The event impacts active Secure Gateway connections for approximately 15 minutes during the outage window(s) and requires you to perform important actions described below
North America
Gateway(s): sgmanagertm1.integration.ibmcloud.com
sg-wdc-*.integration.ibmcloud.com
Window: April 14th, 2021 (3:00 - 4:00 UTC) - Use this tool to calculate your local timezone
Ensure that Outbound port 443 is open for these hostnames:
- sgmanagertm1.integration.ibmcloud.com (208.43.117.195)
tm1-wdc-sgmanager-lb-285900-wdc01.clb.appdomain.cloud.ibm.com (158.85.15.77 and 198.11.253.116) NEW
Europe (Amsterdam)
Gateway(s): sgmanagertm1ams.integration.ibmcloud.com
tm1-eu-sg-*.integration.ibmcloud.com
Window: April 14th, 2021 (3:00 - 4:00 UTC) - Use this tool to calculate your local timezone
Ensure that Outbound port 443 is open for these hostnames:
- sgmanagertm1ams.integration.ibmcloud.com (159.253.157.65)
- tm1-ams-sgmanager-lb-285900-ams01.clb.appdomain.cloud.ibm.com
(5.153.0.16 and 5.153.0.25) NEW
Duration: 15 minutes
Action(s) Required:
- Determine which event impacts you by visiting the Secure Gateway tab in Planning Analytics Administration. Edit active connection Data Source properties to note affected 'Cloud host' addresses. Match to the schedule above to confirm when your Secure Gateway connection will be unavailable.
- Contact your local IT support team to ensure they are aware of the aforementioned changes taking place April 14th to Secure Gateway IPs.
- Please note: these IPs are not static and may change in the future given appropriate notice. Use hostnames if at all possible to avoid being affected by future IP changes.
- Secure gateway connections will restart automatically following maintenance provided your client is v1.8 or later. No upgrade of your local secure gateway client is required
- If determined you are unaffected by this outage, no action is required.
For questions about this scheduled maintenance activity, please contact IBM PA Support.
Thank you,
IBM Cloud Operations Team
