Network planning and the Management Console

You start by writing the HMC network plan as a small CSV and checking it with Python, the way a careful storage admin checks a worksheet before it goes to IBM. After that you look at the management side of the practice DS8A50: both HMCs, their access settings and the SNMP setup.

Practice shell note: the practice shell is our own teaching tool, not IBM software, and its HMC names, addresses and serial numbers are made up for the lab. Real DS CLI output looks very close to this but isn’t identical. The SNMP error in the break lab (CMUN03060E) is a practice shell message, though the rule behind it, at most two trap addresses, is IBM’s.

1Write the HMC network plan

Save this as hmc-plan.csv in C:\ds8k-lab. The other_networks line lists every network the HMC can reach, separated by semicolons, and you need it to catch clashes with the DS8000 private ranges.

Save this as hmc-plan.csv:

item,value
hmc1_ip,10.20.8.21
hmc2_ip,10.20.8.22
netmask,255.255.255.0
gateway,10.20.8.1
dns,10.20.1.53
ntp,10.20.1.123
other_networks,10.20.0.0/16;192.168.40.0/24
snmp_traps,10.20.5.40;10.20.5.41
syslog,10.20.5.50

✅ Checkpoint: hmc-plan.csv has an item,value header and nine rows.

2Write the checker

Save this as hmc_plan.py. It uses Python’s standard ipaddress module to check subnets and overlaps, and the firewall lines it prints come from the Redbook: TCP 1751 and 1755 for the DS CLI, TLS for Call Home and remote support, and traps and syslog for monitoring.

It’s a planning tool that runs on your laptop and checks the plan before any HMC exists. Only the optional --check part talks to the DS8000, through the DS CLI after install, and you’ll use that in step 6.

Save this as hmc_plan.py:

# hmc_plan.py - check a DS8000 HMC network plan (rules from IBM Redbook SG24-8559-01, 5.3 and 6.1-6.5)
# Planning tool: runs on your laptop, not on the DS8000. The plan check needs no DS8000.
# Optional --check (after install) compares the plan with the box through the DS CLI (auto.profile).
import ipaddress, sys
import csv, subprocess
DSCLI = ["python", "ds8sim.py", "-cfg", "auto.profile"]   # at work: ["dscli", "-cfg", "auto.profile"]

def dscli(*args):
    """Run one DS CLI command and return its rows as dictionaries."""
    out = subprocess.run(DSCLI + list(args), capture_output=True, text=True).stdout
    lines = [l for l in out.splitlines() if l and not l.startswith("SaatVedha") and not l.startswith("CMUC")]
    return list(csv.DictReader(lines))

args = [a for a in sys.argv[1:] if a != "--check"]
name = args[0] if args else "hmc-plan.csv"
with open(name, newline="") as f:
    plan = {r["item"]: r["value"] for r in csv.DictReader(f)}

ip = ipaddress.ip_address
net = ipaddress.ip_network(f"{plan['hmc1_ip']}/{plan['netmask']}", strict=False)
private = [ipaddress.ip_network("172.16.0.0/16"), ipaddress.ip_network("172.17.0.0/16")]
problems = []

print(f"HMC subnet: {net}")
for key in ("hmc2_ip", "gateway"):
    if ip(plan[key]) not in net:
        problems.append(f"{key} {plan[key]} is not in {net} (the HMC subnet from hmc1_ip)")
if plan["hmc1_ip"] == plan["hmc2_ip"]:
    problems.append("hmc1_ip and hmc2_ip are the same; each HMC needs its own address")
why = {"dns": "Call Home needs DNS to resolve esupport.ibm.com",
       "ntp": "HMC, hosts and workstations need the same time for error analysis"}
for key in ("dns", "ntp"):
    if not plan.get(key):
        problems.append(f"{key} is empty: {why[key]}")

nets = [net] + [ipaddress.ip_network(n) for n in plan["other_networks"].split(";") if n]
for n in nets:
    for p in private:
        if n.overlaps(p):
            problems.append(f"{n} overlaps the DS8000 private network {p}; ask the IBM SSR for another range")

traps = [t for t in plan.get("snmp_traps", "").split(";") if t]
if len(traps) > 2:
    problems.append(f"{len(traps)} SNMP trap addresses; chsp -snmpaddr takes at most two")

print("Firewall: workstation -> HMCs   TCP 1751 (DS CLI), TCP 1755 (CSM install), HTTPS (DS GUI)")
print("Firewall: HMCs -> outside       Call Home and AOS remote support over TLS, DNS")
print(f"Firewall: HMCs -> monitoring    SNMP traps UDP 162 to {', '.join(traps) or '-'}; syslog 514 to {plan.get('syslog') or '-'}")
print()
if problems:
    print("PLAN PROBLEMS:")
    for p in problems:
        print("  " + p)
else:
    print("Plan OK: ready for the configuration worksheets.")

if "--check" in sys.argv:                 # only after IBM has installed the system
    print()
    hmcs = dscli("lshmc")
    for key, h in zip(("hmc1_ip", "hmc2_ip"), hmcs):
        same = h["Management-IP"] == plan[key]
        print(f"HMC {h['Name']}: {h['Management-IP']}, plan {key} {plan[key]} -> {'OK' if same else 'DIFFERENT'}")
    sp = dscli("showsp")[0]
    keys = [k for k in sp if k is not None]
    vals = [sp[k] for k in keys] + sp.get(None, [])
    extra = len(vals) - len(keys)       # SNMPadd is a comma list, so it spills into extra fields
    i = keys.index("SNMPadd")
    got = sorted(a for a in vals[i:i + 1 + extra] if a != "-")
    print(f"SNMP traps on the DS8000: {', '.join(got) or 'none'} -> {'OK' if got == sorted(traps) else 'DIFFERENT from plan'}")

✅ Checkpoint: hmc_plan.py is saved next to hmc-plan.csv.

3Check the plan

Run this:

python hmc_plan.py

You should see this:

HMC subnet: 10.20.8.0/24
Firewall: workstation -> HMCs   TCP 1751 (DS CLI), TCP 1755 (CSM install), HTTPS (DS GUI)
Firewall: HMCs -> outside       Call Home and AOS remote support over TLS, DNS
Firewall: HMCs -> monitoring    SNMP traps UDP 162 to 10.20.5.40, 10.20.5.41; syslog 514 to 10.20.5.50

Plan OK: ready for the configuration worksheets.

Both HMCs and the gateway sit in 10.20.8.0/24, DNS and NTP are set, no network touches 172.16 or 172.17, and there are two trap receivers. Those three firewall lines are what you send the network team with the change request.

✅ Checkpoint: The checker says “Plan OK”.

4Look at the two HMCs and their access settings

Start clean in the practice shell and run a short management check as a script. You set up lab.profile and security.dat in Lesson 2.

Run this, then save the script below as dayone-hmc.txt:

python ds8sim.py -cfg lab.profile simctl reset

# dayone-hmc.txt - management console checks
lshmc
lsaccess -l
showsp

Run this:

python ds8sim.py -cfg lab.profile -script dayone-hmc.txt

You should see this (after the one-line notice):

Name          State  Role         Release                  Management-IP Location-Code    Machine-Type Machine-Model Memory Disk
================================================================================================================================
DS8A50-1A.LAB Online Primary(1)   R10.1 bundle 10.10.106.0 10.0.0.1      U7063CR2.78SV1DD 7063         CR2           33GB   1TB
DS8A50-1B.LAB Online Secondary(2) R10.1 bundle 10.10.106.0 10.0.0.2      U7063CR2.78SV2DD 7063         CR2           33GB   1TB
hmc  cmdline wui     modem    cim      aos     rsc     vpn
===============================================================
hmc1 enabled enabled disabled disabled enabled enabled disabled
hmc2 enabled enabled disabled disabled enabled enabled disabled
Name           IbmStoragePlex
desc           -
acct           -
SNMP           Disabled
SNMPadd        -
emailnotify    Disabled
emailaddr      -
emailrelay     Disabled
emailrelayaddr -
emailrelayhost -
numkssupported 4
loginprompt    Disabled
promptmessage  -
guisuggestions show

Read it from the top. lshmc shows two 7063-CR2 HMCs, both online, with HMC 1 primary at 10.0.0.1 and HMC 2 secondary at 10.0.0.2, both on the same R10.1 bundle. If the two releases were different, it would mean a code load is half done.

lsaccess -l shows the DS CLI (cmdline) and the Web UI enabled on both HMCs, with remote support set up through AOS and RSC, and the modem, CIM and VPN columns disabled. Changing any of these is a security decision, made with the chaccess command and usually with your security team watching.

showsp shows that the storage complex has no SNMP traps and no email notification yet, which is what you set up next.

✅ Checkpoint: Both HMCs show Online and SNMP shows Disabled.

5Send SNMP traps to your monitoring servers

Your plan has two trap receivers, and chsp takes them as one comma-separated list with no spaces.

Run this:

python ds8sim.py -cfg lab.profile chsp -snmp on -snmpaddr 10.20.5.40,10.20.5.41
python ds8sim.py -cfg lab.profile showsp

You should see this (showsp shortened):

CMUC00040I chsp: Storage complex IbmStoragePlex successfully modified.
Name           IbmStoragePlex
desc           -
acct           -
SNMP           Enabled
SNMPadd        10.20.5.40,10.20.5.41

CMUC00040I is the real message IBM shows for this command. Keep in mind what this setting covers: Copy Services and storage complex traps only. Hardware serviceable-event traps and Call Home are set up on the HMC itself by the SSR, from your worksheets.

Monitoring gets its own, deeper treatment in Lesson 21.

✅ Checkpoint: showsp shows SNMP Enabled with both trap addresses.

6Check the box against your plan

After install, compare what the DS8000 has with what you planned. Scripts get their own profile, so save auto.profile next to ds8sim.py; it uses the security.dat from Lesson 2.

Save this as auto.profile:

hmc1: 10.0.0.1
username: admin
pwfile: security.dat
devid: IBM.2107-78SV001
banner: off
header: on
format: delim
delim: ,

With the banner off, the header on and format delim, the DS CLI prints one header row and then plain comma-separated rows, which a script can read easily.

Run this:

python hmc_plan.py --check

You should see this:

HMC subnet: 10.20.8.0/24
Firewall: workstation -> HMCs   TCP 1751 (DS CLI), TCP 1755 (CSM install), HTTPS (DS GUI)
Firewall: HMCs -> outside       Call Home and AOS remote support over TLS, DNS
Firewall: HMCs -> monitoring    SNMP traps UDP 162 to 10.20.5.40, 10.20.5.41; syslog 514 to 10.20.5.50

Plan OK: ready for the configuration worksheets.

HMC DS8A50-1A.LAB: 10.0.0.1, plan hmc1_ip 10.20.8.21 -> DIFFERENT
HMC DS8A50-1B.LAB: 10.0.0.2, plan hmc2_ip 10.20.8.22 -> DIFFERENT
SNMP traps on the DS8000: 10.20.5.40, 10.20.5.41 -> OK

The script ran lshmc and showsp for you. The trap receivers match the plan but the HMC addresses don’t, because the practice HMCs answer on 10.0.0.1 and 10.0.0.2. On a real install, DIFFERENT here means the SSR set values other than the ones on your worksheet, and you want to find that out before sign-off.

One small detail: SNMPadd is itself a comma list, so in comma-delimited output it spills into the next fields and the script has to join it back together. At work you can have a scheduler on the jump server run this check every week and mail any DIFFERENT line to the storage team.

✅ Checkpoint: The check shows SNMP traps OK and both HMC lines as DIFFERENT in the lab.