ds8900f r9.0 accelerate with ibm storage update · 2019-12-09 · ds8910f flexibility class and...

© Copyright IBM Corporation 2019.

DS8900F R9.0 Accelerate with IBM Storage Update

Brian Sherman, Craig Gordon, Dennis Robertson, Lisa Martinez, Rick Pekosh – WSC Storage

Washington Systems Center - Storage


Accelerate with IBM Storage Webinars

The Free IBM Storage Technical Webinar Series Continues in 2019...

Washington Systems Center – Storage experts cover a variety of technical topics.

Audience: Clients who have or are considering acquiring IBM Storage solutions. Business Partners and IBMers are also welcome.

To automatically receive announcements of upcoming Accelerate with IBM Storage webinars, Clients, Business Partners and IBMers are welcome to send an email request to [email protected].

Located in the Accelerate with IBM Storage Blog: https://www.ibm.com/developerworks/mydeveloperworks/blogs/accelerate/?lang=en

Also, check out the WSC YouTube Channel here: https://www.youtube.com/channel/UCNuks0go01_ZrVVF1jgOD6Q

2019 Upcoming Webinars:

November 21 - TS7700: (Part 1) A New Addition to the Family! and (Part 2) Copying Data Between Clusters and GridsRegister Here: https://ibm.webex.com/ibm/onstage/g.php?MTID=e064cef8fba3cfe4019f2b19d95d585c3

December 10 – Copy Services Manager Update and Bidirectional PPRC links Best PracticesRegister Here: https://ibm.webex.com/ibm/onstage/g.php?MTID=e6037edc31ba8c6d8e6e6670c39134d5d

mailto:[email protected]

https://www.ibm.com/developerworks/mydeveloperworks/blogs/accelerate/?lang=en

https://ibm.webex.com/ibm/onstage/g.php?MTID=e064cef8fba3cfe4019f2b19d95d585c3

https://ibm.webex.com/ibm/onstage/g.php?MTID=e6037edc31ba8c6d8e6e6670c39134d5d



Agenda

• Release 9 Overview

• DS8900F Overview

• Fibre Channel Endpoint Security

• GUI

• EasyTier

• Transparent Cloud Tiering (TCT)

• Miscellaneous

• Performance

3



DS8900F R9.0 – Overview of what’s new

4



DS8900F R9.0 Announcement Summary - Highlights

• DS8900F - Built on Power 9 Servers

• All Flash Array leveraging HPFE G2 enclosures

• Flexibility Class – DS8910F

• Racked / rack independent option

• Up to 512GB cache

• Agility Class – DS8950F

• Double the write cache for 2TB cache configuration

• Power System Upgrade

• Replace DC-UPS with iPDU’s

• NVDIMM for Write Cache retention

• New 19” Rack

• Reduced footprint and height

• New 32 Gb Host Adapter

• Double front-end bandwidth with FCP and FICON

• Fibre Channel Endpoint Security – Authentication and Encryption of Data in Flight

• Built from the DS8880 code base

• Inherits Advanced Function from DS8880

Dates:09/12/2019 Announcement

11/15/2019 General Availability03/13/2020 Earthquake Kit GA

5



R9.0 Announcement Summary

• Announcement date: September 12, 2019

• General Availability date: November 15, 2019 (most countries)

• December 13, 2019 general availability in Armenia, Belarus, Kazakhstan, Kyrgyzstan, Russia, India, South Korea, and Taiwan

• MES Availability date: March 13, 2020

• Earthquake kit general availability March 13, 2020

• IBM Z support of FC Endpoint Security is currently Statement of Direction (SOD)

6



DS8900F R9.0 – Overview

7



DS8910F Flexibility Class and DS8950F Agility Class

• IBM DS8900F family offerings: Flexibility class and Agility class

• Flexibility class: IBM DS8910F

• Replaces DS8882F and DS8884F

• Model 533x-993 IBM Z, LinuxONE, client provided rack (where x= warranty - 1, 2, 3 or 4 years)

• Model 533x-994 IBM rack mounted (where x= warranty - 1, 2, 3 or 4 years)

• Agility class: IBM DS8950F

• Replaces DS8886F and DS8888F

• Model 533x-996 (where x= warranty - 1, 2, 3 or 4 years)

• Expansion model 533x-E96 (where x= warranty - 1, 2, 3 or 4 years)

• Can be adjacent Base frame or up to 20m apart

• All Flash configurations

• Leverages current HPFE Gen2 technology

8



DS8900F – Common Family Capabilities

• All models have single-phase and three-phase power options

• All models have zHyperLink capability

• All models use intelligent Power Distribution Units (iPDUs)

• Either client provided (Model 993) or IBM provided (Model 994 / 996)

• All models use the same function authorization models as the previous generation

• All models include a management enclosure with dual HMCs

• The management enclosure is part of the model bill of materials so no feature codes are required for the HMCs

• All models include 16 / 32 Gb Adapter options

• All models default to Remote Code Load for microcode updates

• All racked models have a height of 40U

• No DS8880/DS8880F to DS8900F model conversion support

9



DS8910F Model 993 – IBM Z, LinuxONE Rack Option

• When installed in a compatible IBM Z or LinuxONE rack:

• One HPFE Gen 2 is supported

• Management Enclosure contains two HMC’s and Ethernet switches

• No need to order iPDUs

• Will use the iPDUs of the IBM Z or LinuxONE rack

• No need to order 1U keyboard/display

• Will use the keyboard/display of the IBM Z or LinuxONE rack

• 15U of contiguous space required

HPFE Gen2 1

10



DS8910F Model 993 – Client provided Rack Option

• When installed in a compatible customer provided rack (conforms to EIA 310D specifications):

• Contiguous rack space is required

• Minimum of 15U / maximum of 20U

• Up to two HPFE Gen 2 pairs are supported

• Requires a minimum of 19U contiguous space with two HPFE enclosures

• Maximum of 20U of contiguous space with two HPFE Gen 2 pairs and 1U keyboard/display


• iPDUs are optional

• Can use the iPDUs of the customer provided rack

• 1U keyboard/display optional

• Can use the keyboard/display of the customer provided rack

HPFE Gen2 1

HPFE Gen2 2

11



DS8900F Model 994 – IBM Racked Option

When installed in an IBM rack:

• 40U rack

• One to four HPFE Gen 2 pairs

• Two to sixteen Host Adapters (HA)

• 4 port 32Gb or

• 4 port 16Gb

• Intelligent rack PDU (iPDU) pair(s)

• One or two I/O Enclosure pairs


• Single or three phase power

12

HPFE Gen2 3

HPFE Gen2 4

HPFE Gen2 1

HPFE Gen2 2



DS8900F Model Summary

ModelProcessors per

SystemCache per

systemExpansion

FrameHAs/Ports

(Max)

HPFE Gen 2 pairs/Flash drives (Max)

zHyperLink Adapters

(Max)

993 * 16-cores 192 GB

N/A 8/32 1/48 4512 GB

993 ** 16-cores 192 GB

N/A 8/32 2/96 4512 GB

994 16-cores 192 GB

N/A 16/64 4/192 4512 GB

996

20-cores 512 GB N/A 16/64 4/192 4

40-cores1024 GB

E96 32/128 8/384 12 ***2048 GB

* Installed in a compatible IBM Z or LinuxONE rack

** Installed in a compatible customer provided rack

*** Maximum 8 in the 996 or the E96; Maximum 12 per system (delivered in pairs)

13



18U

16U

14U

12U

10U

8U

6U

4U

2U

DS8882F DS8910F

DeltaDelta

0123

0123

F2ab F3b

F2bF3b

HPFE Gen2 1

Features DS8882F DS8910FRack Size No Rack No Rack

Min Size 16 U (ZR1 / LinuxONE)17 U (with Keyboard / Monitor)

15U (ZR1 / LinuxONE)16 U (with Keyboard / Monitor)

Max Size 17 U (with Keyboard / Monitor) 20 U (with Keyboard / Monitor)

Processor complex (CEC)

2 – Power 8 2 – Power 9 MTM 9009-22A

IO Bay Pairs 1 – 2U 1 – 5U

Max HA Ports 16 Ports16Gb 4-port HA

32 Ports16Gb 4-port HA32Gb 4-port EDiF HA

Max Flash cards 48 96

Max HPFE Gen2 1 2

4U UPS Single phase per rack

2 0

HMC Drawer 2 – HMC2 - Ethernet Switches

2 – HMC2 - Ethernet Switches

Keyboard/Monitor 1 - 19” Rack mounted 1 - 19” Rack mounted

zHyperLink 0 - Not supported Max of 4 - Supported

34U

32U

30U

28U

26U

24U

22U

20U

18U

16U

14U

12U

10U

8U

6U

4U

2U

HPFE Gen2 1

HPFE Gen2 2

DS8882F to DS8910F Comparison

For IBM Z Model ZR1 or IBM LinuxONE Rockhopper II LR1

Client provided industry standard 19-inch racks

14

http://powerquality.eaton.com/Products-services/Backup-Power-UPS/9130-RM-UPS/9130-RM-demo/default.asp?model=L2500

http://powerquality.eaton.com/Products-services/Backup-Power-UPS/9130-RM-UPS/9130-RM-demo/default.asp?model=L2500



HMC HMC

40

38

36

34

32

30

28

26

24

22

20

18

16

14

12U

10U

8U

6U

4U

2U

HPFE Gen2 1

HPFE Gen2 2

HPFE Gen2 3

HPFE Gen2 4

Features DS8884F DS8910F

Rack Size 19” 600x1200, 40U Variable 19” 600x1050, 40U fixed

Max number of racks 1 1


2 – Power 8 2 – Power 9 MTM 9009-22A

IO Bay Pairs 2 2

Max HA Ports 64 - Ports8Gb 4/8-port HA16Gb 4-port HA

64 - Ports16Gb 4-port HA32Gb 4-port EDiF HA


Max HPFE Gen2 4 4

8U DC-UPS 2 0 - Replaced with 2 to 4 iPDUs

Power Phase Single Phase Single Phase Three Phase

Line Cords per Rack 2 2 to 4

HMC 1 or 2 – Seating in UPS slot 2 – Contained in HMC Drawer

Ethernet Switches 2 – Mounted on side of Rack 2 – Mounted in HMC drawer

Keyboard/Monitor 1 – Custom Mounted on side of Rack

1 - 19” Rack mounted

DS8884F DS8910F

HPFE Gen2 3

HPFE Gen2 4

HPFE Gen2 1

HPFE Gen2 2

DS8884F to DS8910F Racked Comparison

40

38

36

34

32

30

28

26

24

22

20

18

16

14

12U

10U

8U

6U

4U

2U

15



46

44

42

40

38

36

34

32

30

28

26

24

22

20

18

16

14

12

10

8

6

4

2HMCHMC

4U

12U

HPFE Gen2 1

HPFE Gen2 2

HPFE Gen2 5

HPFE Gen2 6

HPFE Gen2 3

HPFE Gen2 4

HPFE Gen2 7

HPFE Gen2 8

HMC HMCHMC HMC

8U

TH 3

TH 4

TH 4

8U

HPFE Gen2 1

HPFE Gen2 2

HPFE Gen2 5

HPFE Gen2 6

HPFE Gen2 3

HPFE Gen2 4

HPFE Gen2 7

HPFE Gen2 8

DS8886F Single Phase DS8886F Three Phase

46

44

42

40

38

36

34

32

30

28

26

24

22

20

18

16

14

12

10

8

6

4

2

IBM DS8950F

HPFE Gen2 1

HPFE Gen2 2

HPFE Gen2 7

HPFE Gen2 8

HPFE Gen2 5

HPFEGen2 6

Features DS8886F DS8950F

Rack Size 19” 600x1200, 40-46U variable

19” 600x1050, 40U - fixed

Max number of racks

2 2


2 – Power 8 2 – Power 9 MTM 9009-42A

IO Bay Pairs 4 4

Max HA Ports 128 Ports8Gb 4/8-port HA16Gb 4-port HA

128 Ports16Gb 4-port HA32Gb 4-port EDiF HA


Max HPFE Gen2 8 8

8U/12U DC-UPS

2 0 - Replaced with 2 to 6 iPDUs

Power Phase Single PhaseThree Phase

Single PhaseThree Phase

Line Cords Per Rack

2 2 to 4

HMC 1 or 2 – Seating in UPS slot 2 – Contained in HMC Drawer

Ethernet Switches

2 – Mounted on side of Rack

2 – Mounted in HMC drawer2 - 19” Rack mounted (optional)

Keyboard / Monitor

1 – Custom Mounted on side of Rack

1 - 19” Rack mounted

HPFE Gen2 4

HPFEGen2 3

DS8886F to DS8950F Comparison

16



IO Bay Pair

IO Bay Pair

B Rack

DS8950F Expansion Rack (E96) at Distance

• Optical PCIe IO Bay Interconnect• A/B rack can be located up to 20 meters from each other• Does not require planning at installation if additional capacity will

be required at later point • Allows for better data center aisle planning• Distance Feature Code, FC1341, will cover cost of optical cables

and transceivers per bay pair

Optical PCIe IO

Bay Interconnect

A to B Rack

Optical

Op

tics

Op

tics

<= 20mNode 1

Node 2

IO Bay Pair

IO Bay Pair

A Rack

Op

tics

17



DS8900F 32Gb Host Adapter – FCP / FICON

• 32Gb FC / FICON connectivity

• 4 port adapter

• Up to 32 HA, 128 ports

• Auto-negotiate to 16Gb FC, 8Gb FC

• No FC-AL connections

• Enables FC Endpoint Security

• Authentication

• Encryption of Data in Flight (EDiF)

• Preservation of prior adapter capabilities:

• Forward Error Correction (FEC) for the utmost reliability at 16Gbps and 32Gbps speeds

• Lights on Fastload avoids path disturbance during code loads

• Read Diagnostic Parameters (RDP) support

• zHPF extended distance performance feature

• (zHPF Extended Distance II) using FC-SB-6 FTBC to prevent SAN congestion and eliminate long distance handshake latency

Note: Existing 4 port 16Gb HA also supported

18



32Gb Cable Requirements

• From Fibre Channel Physical Interface (FC-PI-6), the 32G standard running at 32Gb

• https://standards.incits.org/apps/group_public/download.php/55439/eb-2014-00174-Public-review-%20register-INCITS-512-201x-Comments-due-05-26-2014.pdf

• Enough Buffer Credits to support 32Gb at 10km

Max operating distance and loss budget for different connection losses

19

https://standards.incits.org/apps/group_public/download.php/55439/eb-2014-00174-Public-review-%20register-INCITS-512-201x-Comments-due-05-26-2014.pdf



DS8900F AFA Media Options – All Encryption Capable

• Flash – 2.5” in High Performance Flash Tier 0• 800GB, 1.60/3.20TB Flash cards

• Flash – 2.5” High Capacity Flash Tier 1• 3.84TB Flash cards

• Flash – 2.5” High Capacity Flash Tier 2• 1.92 (DS8910F only) /7.68/15.36TB Flash cards

• Data is always encrypted on write to Flash and then decrypted on read • Data stored on Flash is encrypted

• Data in flight is not encrypted unless Pervasive Encryption or Fibre Channel Endpoint Security utilized

• Media does the encryption at full data rate• No impact to response times

• Uses AES 256 bit encryption

• Supports cryptographic erasure data • Change of encryption keys

• Requires authentication with key server before access to data is granted• Key management options

• IBM Security Key Lifecycle Manager (SKLM)

• SKLM + IBMJCEFIPS provider is FIPS140-2 certified

• z/OS2.4 Container Extensions (zCX) can run IBM Security Key Lifecycle Manager in a container

• KMIP compliant key manager such as SafeNet KeySecure

• Key exchange with key server is via 256 bit encryption

20



DS8900F Capacity Summary

Maximum usable capacity with largeextents and max system cache

ReleaseR9.0/4Q19

(with 15.36 TB flash)

DS8910F Rackless

1474.56 TB

DS8910FRacked

2000 TB

DS8950F 5898.24 TB

Maximum usable capacity with smallextents and max system cache

ReleaseR9.0/4Q19

(with 15.36 TB flash )

DS8910F Rackless

512 TB

DS8910FRacked

512 TB

DS8950F 2000 TB

Maximum usable and virtual capacity for large and small extents based on the cache size

CacheMax usable size

with large extentsMax virtual size

with large extentsMax usable size with small extents

Max virtual size with small extents

< 512 2 PB 4 PB 512 TB 1 PB

> 512 8 PB 16 PB 2 PB 4 PB

21



DS8900F High Performance Flash Enclosure (HPFE) Gen2

• Performance optimized High Performance Flash Enclosure

• Each HPFE Gen2 enclosure

• Is 2U, installed in pairs for 4U of rack space

• Concurrently installable

• Contains up to 24 SFF (2.5”) Flash cards, for a maximum of 48 Flash cards in 4U

• Flash cards installed in 16 drive increments – 8 per enclosure

• Flash card capacity options

• 800GB, 1.6TB , 3.2TB High Performance Flash

• Intermix of 3 different high performance flash card capacities is allowed via RPQ

• 1.92 (DS8910F only) / 3.84 / 7.68 / 15.36TB High Capacity Flash

• Intermix of 3 different high capacity flash card capacities is allowed via RPQ

• RAID6 default for all DS8900F media capacities

• RAID5 option available for 800GB Flash cards

22



DS8900F High Performance Flash Enclosure (HPFE Gen2)

High Performance Flash Enclosure Gen2

Size 4U

Flash card options 800 GB, 1.60 / 3.20 / 1.92 / 3.84 / 7.68 / 15.36 TB

Number of supported flash cards 16, 32 or 48

Min/Max raw capacity 12.8TB (w/800GB Flash) / 737.28TB (w/15.36TB Flash)

RAID protection 5 / 6 /10 (Default is RAID6)

Attachment Two PCIe Gen 3 Eight SAS 6Gb for attachment to the Gen2 enclosure

Install groups 3 install groups of 16 Flash cards each (6 array sites)

Intermix of 3 different High Performance Flash or High Capacity Flash is allowed via RPQ

HPF: 800GB, 1.6/3.2TB or HCF: 1.92/3.84/7.68/15.36TB

Increments Populate in increments of a single storage group consisting on: One High-Performance Flash Enclosure Gen2 + Two IO / Micro Bays

Performance IOPS Throughput

Read 900,000 RAID 6 +65% 14 GB/s RAID 6

Write 225,000 RAID 6 9.5 GB/s RAID 6

Latency 160uSec

23



DS8900F - Fibre Channel Endpoint Security

24



Multiple Layers of Encryption to meet Clients RequirementsRobust data protection

Coverage

Co

mp

lex

ity

an

d S

ec

uri

ty C

on

tro

l

App Encryption

hyper-sensitive data

Database EncryptionProvide protection for very sensitive in-use (DB level),

in-flight and at-rest data

File or Dataset Level EncryptionProvide broad coverage for sensitive data using encryption tied to access control

for in-flight and at-rest data protection

SAN Link Encryption + Full Disk and Tape EncryptionProvide 100% data protection for data at rest protection with zero host CPU cost

Protection against intrusion, tamper or removal of physical

infrastructure

Broad protection and privacy managed by OS… ability to eliminate storage

admins from compliance scope

Granular protection and privacy managed by database… selective encryption and granular

key management control of sensitive data

Data protection and privacy provided and managed by the application… encryption of sensitive data when lower levels of encryption not available or suitable

25



Comparison of data encryption techniques

• Storage Subsystem

• Data at Rest Encryption

• Utilizes media (Flash/SSD/HDD) to do the encryption

• Data encrypted once it is destaged to the media

• No overhead

• Transparent to application

• All data on a DS8000 or none

• Designed to protect against

• Media failures/removal

• Subsystem removal

• z/OS Data Set

• Data in flight as well as at rest

• Utilizes RACF/DFSMS

• Selective encryption based on clients policy requirements

• BSAM/QSAM Extended format data sets

• VSAM, DB2, IMS, Logs

• Minimal CPU overhead

• Transparent to applications


• Mis-identification/classification of critical data

• z/OS Database

• Data in flight as well as at rest

• Utilizes software

• Data encrypted inside the Database

• Data in buffers also encrypted

• Granular encryption

• Row / column for DB2

• Segment for IMS

• CPU overhead tied to amount of data to be encrypted

• Transparent to applications


• Unauthorized viewing of database sensitive data

26

• FC Endpoint Security

• Data in flight

• Authentication and Encryption capability

• IBM Z15 and DS8900F

• No performance overhead

• IBM Z OS independent -z/OS, z/VM, z/Linux supported

• Transparent to application


• Authentication - ensures data is accessed only by trusted IBM Z, LinuxONE and DS8900F Systems

• Encryption - data in-flight within and across data centers



Fibre Channel Endpoint Security – Client Value

• Clients who desire to ensure business and customer data is accessed only by trusted servers and

storage devices within and across datacenters can leverage the IBM Fibre Channel Endpoint

Security … without application, operating system, or file system changes and without consuming

host CPU cycles

• Enabled automatically between host and storage endpoints that are ‘security-capable’

• Each established link must ‘prove’ its identity as a trusted component

• Trusted connections are identified; visible to both OS and HMC

• Policy can be established to enforce that only trusted connections can be made

• Each time a link goes down/up re-authentication/negotiation of encryptions keys occurs

• Zero host CPU cost

• Integrated and automated key management

Designed to take advantage of the most reliable and resilient enterprise storage

technology!!!

1

2

3

4

5

6

7

27



Fibre Channel Endpoint Security

Endpoint Security consists of two categories:

• Authentication of identities and rights to access

• Endpoint Authentication

• Integrity and confidentiality of data transferred between entities

• Encryption of Data in Flight or EDiF

28



IBM Security Key Exchange (SKE) protocol

• The IBM Security Key Exchange (SKE) protocol is used to establish a trusted, validated relationship

between two Fibre Channel Endpoints

• SKE is based on Internet Key Exchange version 2 (IKEv2) protocol, and Fibre Channel – Security

Protocol -2 (FC-SP-2) standard constructs

• As part of the SKE messages, an identifier of the created key will be passed to the target CU, and

the CU will make a secure connection to ISKLM and request the ‘shared secret’ from the ISKLM key

server

• If credentials are successfully validated, the CU will successfully retrieve the ‘shared secret’

• The ‘shared secret’ will be used in IKEv2-based algorithms

• to derive keys used to decrypt/encrypt the SKE messages required to provide 2-way authentication and negotiation of

encryption algorithms

• and derivation of link encryption keys for EDiF.

29



Solution Components

SAN

External Key

Manager

Supports both point-to-point and fabric (switched)

topologies

IBM SKE

KMIP = Key Management Interface Protocol

IBM SKE = IBM Security Key Exchange

Secure TLS connections

Connected in a Multi-

Master group of 2-4

ISKLM instances

Communication with External Key Manager on both z and storage provided through network connection from HMC

30



Fibre Channel Endpoint Security – Solution Requirements

• IBM z15 support is currently an SOD

• Cisco / Broadcom requires firmware update

• DS8900F requires:

• New 32Gb FC HA (authentication and encryption-capable)

• Existing 16Gb FC HA for authentication-only

• IBM Security Key Lifecycle Manager requires version 3.0.1:

• Required to serve a shared key to the server and storage boxes that is used to secure messages between the endpoints in which further key material is derived for data protection

• Required that ISKLM be configured in Multi-Master mode for High Availability (2 to 4 instances, although will function with a single instance, when failures occur)

IBM z15

DS8900F

31



DS8900F Endpoint Security Policy Control

• DS8900F Port-level Configuration – DSCLI or GUI

• Security Disabled

• Logins will not indicate support for security

• Security Enabled

• The port will allow security protocols to negotiate the use of Link Authentication or EDIF, but

will not enforce the use of Link Authentication or EDIF before allowing I/O

• Security Enforced

• The port requires secure login and the use of security protocols for successful negotiation of

Link Authentication or EDIF before allowing I/O.

Host ports that do not support security or do not complete authentication will be logged out or

denied login.

• NOTE: The process of changing security features associated with a port will take the port offline and back

online. This includes enabling, disabling, or changing from one to the other.

• It is highly recommended that the host(s) are enabled for security and ISKLM is operational before enabling

security on DS8K ports

32



DS8900F User Interface - Configure

• ISKLM

• Export ISKLM key server certificates from each external key manager

(ISKLM GUI or openssl s_client –connect)

• ISKLM already has Root CA signing certificate for DS8K Gen2 certs so

no need to import DS8K cert to ISKLM

• DS8900F

• Configure key managers and create the Endpoint Security keygroup

using either user interface

• DSCLI (mkkeymgr and mkkeygrp) or

• DSGUI (Endpoint Security) user interfaces

• Configure Host Adapter ports

• DSCLI (setioport –security {disabled | enabled | enforced}

• DSGUI Fibre Channel Ports setting - "Modify Endpoint Security" action

33



DS8900F User Interface - Visibility

• Secure Host Logins to a specified port:

• Number of logins to port

• Number of secure capable logins (both sides capable)

• Number of Authenticated-only logins

• Number of Authenticated logins that enable encryption

• If Secure Capable logins <> Authenticated-only +

Authenticated w/ encryption, there is a problem

• DSCLI showioport –metrics or lsioport –metrics

• GUI – Network | Fibre Channel Ports | Modify Endpoint

Security

34



Summary

• IBM is delivering the first end to end Fibre Channel security solution

• The solution solves the scale issues of management of certificates and

shared secrets through automation and use of the IBM SKLM key

server’s Peer to Peer device groups

• Encryption of data in flight between IBM Z and DS8900F in the SAN

broadens the coverage for IBM’s Pervasive Encryption story

• IBM Fibre Channel Endpoint Security redbook coming in November, 2019

with full setup procedures on monitoring capabilities for ISKLM, Z15 and

DS8900F

35



DS8900F - GUI

36



IBM Storage Design Language

37


Capacity Terminology

• DS8000

• Allocated capacity

• Spectrum Virtualize _____

• Stored capacity

• Spectrum Accelerate

• Provisioned capacity

• Storage Insights

• … which do we use?

38





• Raw capacity

• Usable capacity

• Used capacity

• Effective

• Thin Provisioning

• Overprovisioning

39



IBM DS8900 GUI Dashboard – No New Training!

HomeAlerts

DSCLI40



What’s New!

• 32 Gb Host Adapter support

• IBM i – Dynamic expansion of Variable Size LUNs, 050 protected and 099 Unprotected

• Easy Tier speed selector

• Gen3 Certificates – Gen2 and User Signed Certificates are still supported

• IBM Fibre Channel End Point Security

41



What’s Changed!

• No 8 Gb Host Adapter support

• No IO Priority Manager

• No Legacy GUI

• No SIM-S Agent support

42



DS8900F – Easy Tier

43



Easy Tier – migration speed improvement – phase 1

• Created in response to customer requests for enhanced migration performance. Additionally, with

the advent of flash, which far exceeds the capacity of spinning disks, All Flash Array

implementations, such as the DS8900F, will continue to get bigger. Therefore, more Easy Tier heat

map data to process during the 5 minute learning cycle

• The new feature is known as “acceleration mode” and is enabled thru either the DSGUI and DSCLI

(examples of each appear on following slides)

• Without “acceleration mode” enabled Easy Tier can migrate up to ~24 GB per 5 minute cycle

• With “acceleration mode” enabled Easy Tier can migrate up to ~60 GB per 5 minute cycle – which is

a 2.5X increase. (based on IBM Enterprise Storage Performance team testing)

• Default for “acceleration mode” is Disabled (i.e., it is turned off)

44



Easy Tier – migration speed improvement – DSGUI example

• DSGUI “acceleration mode” enablement:

3 Easy Steps on the GUI:> Go to “Settings”

> Select “Easy Tier”> Change “Easy Tier automatic mode acceleration:”

dropdown value to “Enable” or “Disable”

45



Easy Tier – migration speed improvement – DSCLI examples

• DSCLI “acceleration mode” enablement via “chsi” command with “-etautomodeaccel enable” parm:

dscli> chsi -etautomodeaccel enableDate/Time: August 18, 2019 11:23:32 PM MST IBM DSCLI Version: 7.9.0.409 DS: -

CMUC00042I chsi: Storage image IBM.2107-75XXXX1 successfully modified.

dscli> showsiDate/Time: August 18, 2019 11:23:45 PM MST IBM DSCLI Version: 7.9.0.409 DS: -

Name -

desc -

ID IBM.2107-75XXXX1

…

ETAutoModeAccel Enabled

• DSCLI “acceleration mode” disablement via “chsi” command “-etautomodeaccel disable” parm:

• DSCLI “acceleration mode” check status via “showsi” command

dscli> chsi -etautomodeaccel disableDate/Time: August 18, 2019 11:23:45 PM MST IBM DSCLI Version: 7.9.0.409 DS: -

CMUC00042I chsi: Storage image IBM.2107-75XXXX1 successfully modified.

46



Easy Tier – generate skew curve report for disk performance modeling

• Easy Tier Skew Curve Report is one of the inputs to Disk Magic for backend configuration sizing.

• For All Flash Arrays, Easy Tier algorithm was changed to sort extents using Total (Random + Sequential) I/O heat instead of only Random I/O heat. So,

• Skew Curve Report is generated by sorting extents’ Total I/O heat accordingly.

• Skew curve diagram represents Total I/O across tiers

• Add Write I/O distribution across tiers to help evaluate Disk Writes per Day (i.e., “DWPD”)

In this hybrid configuration (SSDs + Enterprise HDDs), the SSDs perform most of the random I/O while the HDDs perform most of the sequential I/O. This workload is sorted by random I/O. Notice that the SSDs comprise < 5% of total capacity, but process over 80% of the workload.

AFAs are composed of High Performance &/or High Capacity Flash. HPF have a performance advantage over HCF for both random & sequential I/O. Starting with R9 Easy Tier will sort extents on Total I/O (i.e., random + sequential). Note, in this example, the HPF, which is < 15% of total capacity, is handling over 80% of the workload.

HPF HCF

Hybrid – Skew Curve sorted on Random I/O AFA – Skew Curve sorted on Total I/O

SSD Enterprise HDD

47



Other Easy Tier Enhancements

• As noted earlier, flash drive sizes continue to get bigger, disk configurations will continue to get bigger, too. To prepare for larger configurations in the future, R9 includes a couple of enhancements that enable Easy Tier to complete its learning cycle while processing more heat map data

• Cross memory heat map sharing (dramatically improves learning cycle process time)• Adaptively calculate the time weighted moving average to prevent potential timeouts during the

learning cycle

48



DS8900F – Transparent Cloud Tiering (TCT)

49



DS8900F Transparent Cloud Tiering Support

50

TCT with Copy Services

Metro Mirror with HyperSwap

(CSM/GDPS)

Global Mirror

Metro Global Mirror

Multi Target PPRC

FlashCopy

Object Store Support

IBM Cloud Object Storage

IBM Cloud

Amazon AWS S3

Generic S3 API

TCT Features

Z MIPs reduction in

conjunction with DFSMShsm

TCT Encryption Supported

1 Gbit and 10 Gbit Ethernet

Public/Private Cloud Storage

• TCT on the DS8900F will support all of the features and functions from DS8880

• While the DS8900Fs support 1 Gb and 10 Gb ethernet connections just like the DS8880s, there is one key difference. For the 10 Gb adapter only – it is a Short Reach (“SR”) connection rather than Long Reach (“LR”)

• Short Reach adapter is more cost effective

• Feedback from customers indicates that Short Reach is more prevalent in their respective data center switching infrastructures



TCT with TS7700 Object Store

51

DS8000 CEC

TS7700 Data

Movement Engine

TS7700

TS7700 Data Server

TS7700 Filesystem

IBM DS8000 IBM TS7700

Ethernet / GRID Links

• TS7700 Filesystem

• Object Partition

• Container

• Objects

• Customer Data

Object

• Dataset Metadata

• Co-existence of FICON Tape and TCT Object workloads to the same TS7700 cluster

• Data flows from DS8000 to TS7700 via GRID network links

• Utilizes logical partitions to allocate storage from resident cache (CP0) specifically dedicated to TCT objects

• Supports data redundancy via writing to two TS7700 clusters within the same GRID



Support for DS8000 TCT with TS7700 as an Object Store

52

• DS8880 and DS8900F supported (all models)

• Part of the zSynergy License Bundle

• DS8880 R8.5 SP4 minimum level

• DS8900F R9.0 minimum level

• Ethernet connections – Warning: DS8900F 10Gb Ethernet CANNOT direct connect to TS7700 GRID adapters(SR vs. LR connectivity). DS8880 10Gb Adapters can direct connect.

• TS7760 (VEC) and TS7770 (VED) supported

• Minimum code level is R5.0

• Feature Code #5282

• TS77X0T tape attached, TS77X0C cloud attached, TS77X0 tapeless supported (where ‘X’ is either ‘6’ or ‘7’)

• Uses existing GRID adapters and will share TCPIP traffic with the GRID

• z/OS V2R2, V2R3 and V2R4 supported

• APARs required to enable ”TAPE-OBJECT” type in SMS Cloud Construct/Network Connection panel



More on TCT with TS7700 as an Object Store

53

• Multiple DS8000s can be connected to a single TS7700

• GRID Replication is not supported in this release

• Classes (Mgmt, Storage) and DFSMS policies have no effect on objects

• Data redundancy is achieved by forking writes from the DS8000 to two clusters in a GRID

• DS8000 will also handle resync when a TS7700 cluster goes offline

• DS8000 can connect to a cluster that has a physical tape connected (e.g., TS7760T) or cloud connected (e.g., TS7770C)

• Further migration of objects to physical tape and cloud object store is not supported in this release

• TCT Encryption is not supported in this release

• Data is not compressed as it enters the TS7700

Grid Cloud

Clo

ud

Clo

ud

TS7760C TS7770CTS7760T TS7770T

DS8880 DS8950 DS8880

Ethernet

Z System

FIC

ON

FIC

ON



z/OS Changes in SMS Panels to support TS7700 Object Store

54

Panel Utilities Scroll Help

-----------------------------------------------------------------------------

NETWORK CONNECTION DEFINE Page 1 of 2

Command ===>

SCDS Name . . . . . . . : SYSA.SMSSCDS

Network Connection Name : ZOSCLOUD

To DEFINE Network Connection , Specify:

Description Cloud Storage for DFSMShsm Data

____________________________________________________________

Provider . . TAPE-OBJECT______ (SWIFT, SWIFT-KEYSTONE, TAPE-OBJECT)

Identity . . [email protected]

________________________________________________________________________________

________________________________________________________________________________

Use ENTER to Perform Verification; Use DOWN Command to View next Panel;

Use HELP Command for Help; Use END Command to Save and Exit; CANCEL to Exit.

Set Provider to “TAPE-OBJECT” for TS7700 Object Store

• z/OS SMS panel:



TS7700 Configuration for Object Store support

• Configuration and enablement of TS7700 as an object store must be done before running mkcloudserver on the DS8000.

• IBM SSR support required for enablement and configuration on TS7700

• Enablement of feature code #5282

• Addition of DS8000 IP addresses into TS7700 via SMIT

• Supports 2 IPs per CEC for redundancy

• MI (management interface) capabilities for customer

• View Object Partition in the Cache Partitions page

• Objects will be included in the capacity used ”tube”

• Resizing of the object partition (both increase and decrease) concurrent

• LIBREQ commands for object throughput on GRID Links, partition utilization and more available

55



DS8000 DSCLI configuration of TCT with TS7700 as an Object Store

mkcloudserver -type TS7700 -primary7700IPs 1.1.1.1,1.1.1.2 [-secondary7700IPs] 2.2.2.2,2.2.2.3 -nosslcloud_name

• “-type” needs to be set to “TS7700”

• IP addresses used here are GRID IP addresses in the TS7700

• For TCT to a single TS7700 cluster (no forking), a list of GRID IP are used with ”primary7700IPs”

• If you want to use forking (data redundancy), a list of GRID IPs are used with “secondary7700IPs.”This parameter is optional.

• cloud_name needs to match the z/OS SMS Panel

• Initial mkcloudserver command to the TS7700 validates communication and will create the dependent fileset and set up structures and quotas on the TS7700

56



DS8900F - Miscellaneous

57



HMC Code Image Server for Remote Code Load (RCL)

• Today, every Remote Code Load must acquire the code bundles from Fix Central individually

• For certain geographies this can take hours upon hours to successfully acquire

• HMC Code Image Server allows a single HMC in the customer’s data center to acquire code from Fix Central and then serve those images to other HMCs via the customer’s own LAN

• Greatly increases efficiency for these environments which allows for greater acceptance for RCL

• Utilizes the same design point that replicates bundles between HMCa and HMCb

• Supports replication many different types of code

• DS8000 Code Bundles, ICS Images, HMC Recovery Images

• Available on the DS8900F R9.0 and DS8880 R8.5SP4

IBM Fix Central

Acquire code from

Fix Central to a

single DS8k HMC

Remote acquisition,

distribution and

activation.

IBM Service

Customer’s data center

58



HMC Code Image Server Steps

1. Acquire Code Bundle from Fix Central on a DS8k HMC

2. Enable the Code Image Server on the HMC WUI

3. File Server will display the Bundle Images, ICS and HMC Recovery Images available to be served

4. On any target HMC in the customer data center, use the Remote File Download

5. Enter the HMC Code Image Server IP address or FQDN

– This will replicate the served code from the Code Image Server to this HMC

6. Acquire the code but instead of Fix Central, use the HMC /extra/BundleImage/ Directory option

7. CDA Preload will kick off as usual after the acquire is completed

Warning: This only works on Fix Central acquired code.

Does not work for images acquired by physical media (DVD, SuperShipper) or network acquire (GSA).

59



HMC Code Image Server Steps – Screen Shots

60



Parallel Alias Volumes (PAV)

• PAV Management Improvement• Relieve address contention to base volumes

• Current Implementation:• Operate on one PAV at a time• Each PAV assigned to BaseV

• New Implementation• Operate on one BaseV at a time

• Performance Improvements• 7.7 seconds for 128 PAV creations

• Previously took 4.2 minutes

61



Dynamic Volume Expansion for IBM i

• Dynamic volume expansion is the capability of the DS8900F to increase volume capacity up to a maximum size while volumes are online to a host and not in a Copy Services relationship

• Dynamic volume expansion increases the capacity of IBM i volume while they remain connected to a host system. This capability simplifies data growth by providing volume expansion without taking volumes offline

• DS8900F will support volume expansion on IBM i 050 and 099 volume types

• DS8900F supports volume increments of 1GB to max of 2000GB for indicated volumes

• IBM i Minimum Required Software Level• IBMi 7.3 TR6 • IBMi 7.4 Original

Capacity

Expanded

Capacity

62



Removed Functionality

• Oracle Hard Capability• Hardware assisted resilient data, prevents database corruption• No demand

• CS-PPRC: Removing support for Cascaded Failover state by exploiting Multi-target Failover• Multi-target is now fully supported• Replaced cascaded failover on cascaded Metro-Global Mirror

• IO Priority Manager• Incompatible with zHyperLink• Little demand

• Subsystem Device Driver (SDD)• SDD-PCM (Path Control Module) on AIX replaced by AIX-PCM• SDD_DSM (Device Specific Module) on Windows replaced by MS-DSM• https://www-01.ibm.com/support/docview.wss?uid=ibm10959403

• UI-DSGUI legacy • Current DS-GUI replacing legacy. No longer support legacy

63

https://www-01.ibm.com/support/docview.wss?uid=ibm10959403



DS8900F - Performance

64



z/OS OLTP – Db2 with zHPF - IOPs

65

0

500

1000

1500

2000

2500K

IO/s

z/OS OLTP - Db2 zOS with zHPF (75/25/72)

DS8950F p9 40 core/8 HPFE_Gen2 (384 Flash Cards)



DS8886 p8 48 core/4 HPFE_Gen2 (192 Flash Cards)



DS8870 p7+ 32 core/8 HPFE (240 Flash Cards)

DS8870

32 core

DS888648 core

DS8950F40 core

DS8950F20 core

DS8910F16 core

DS888632 core

DS888424 core



Open OLTP (DB Open) - IOPs

0

500

1000

1500

2000

2500K

IO/s

Open OLTP (DB Open – 70/30/50)

DS8950F p9 40 core/8 HPFE_Gen2 Pair (384 Flash Cards)



DS8886 p8 48 core/4 HPFE_Gen2 Pair (192 Flash Cards)



DS8870 p7+ 32 core/8 HPFE (240 Flash Cards)

DS888648 core

DS8950F40 core

DS8950F20 core

DS8910F16 core

DS888632 core

DS888424 core

DS887032 core

66



Open OLTP (DB Open) – Response Time

67

0

0.05

0.1

0.15

0.2

0.25

0.3

0.35

0.4

0.45

0.5

0 500 1000 1500 2000 2500

Re

sp

on

se

Tim

e (

ms)

IO Rate (KIO/s)




DS8886F p8 48 Core/4 HPFE_Gen2 (192 Flash Cards)

DS8886F p8 32 Core/4 HPFE_Gen2 (192 Flash Cards)

DS8884F p8 24 Core /2 HPFE Gen2 (96 Flash Cards)



0

2

4

6

8

10

12

14

16

18

20

Sequential Read Sequential Write

GB

/s

DS8910F Rack independentDS8882F

1.71x

2.57x

DS8910F Rack Independent vs DS8882F - Sequential

68

DS8910F vs DS8882F• DS8910F Rack independent increases Sequential read

performance by 157% and Sequential write performance by 71% by using same IO Enclosure as DS8910F Racked

• 18GB/s Read (DS8910F) vs 7GB/s Read (DS8882F)• 12GB/s Read (DS8910F) vs 7GB/s Write (DS8882F)



Future Made

Future Made

DS8910F vs DS8884F Performance - IOPs

0

0.1

0.2

0.3

0.4

0.5

0.6

0 100 200 300 400 500 600 700 800 900 1000

Res

po

nse

Tim

e (

ms)

IO Rate (KIO/s)


DS8910F p9 16 core/4 HPFE_Gen2_Pair (192 Flash Cards)

DS8884F p8 24 Core /2 HPFE Gen2_Pair (96 Flash Cards)9 - 19% RT reduction

1.6x70% of real world DS8880

environments do less

than 250K IOPS

• DS8910F increases IOPs by 60% at 0.3ms RT• Typical production environments will benefit from 9%-19% reduction in

response times

69



Future Made

Future Made

DS8950F vs DS8886F Performance

• DS8950F increases IOPs by 38% at 0.3ms RT• Typical production environments will benefit from a 9% reduction in response times

0

0.05

0.1

0.15

0.2

0.25

0.3

0.35

0.4

0.45

0.5

0 500 1000 1500 2000 2500

Res

po

nse

Tim

e (

ms)

IO Rate (KIO/s)


DS8950F p9 40 core/8 HPFE_Gen2_Pair (384 Flash Cards)

DS8886F p8 48 Core/4 HPFE_Gen2_Pair (192 Flash Cards)

9% RT reduction

1.38x

99% of real world DS8880

environments do less than

1M IOPS

70



Future Made

Future Made

IBM DS8950F vs DS8886F vs DS8888F Performance

• DS8950F (40 core) increases IOPs by 38% at 0.3ms RT vs DS8886F

• Typical production environments will benefit from a 9% reduction in response times vs DS8886F & DS8888F

Lower response time equates to faster job completion

0

0.05

0.1

0.15

0.2

0.25

0.3

0.35

0.4

0.45

0.5

0 200 400 600 800 1000 1200 1400 1600 1800 2000 2200 2400 2600 2800 3000 3200 3400

Response T

ime (

ms)

KIOPs

Database Open (70% read, 30% write, 50% read hit) 4KB IO

DS8950F

DS8886F

DS8888F

1.38X9% RT reduction

0.15

0.2

0.25

0 200 400 600 800 1000 1200 1400

Re

spo

nse

Tim

e (

ms)

KIOPs


DS8950F

DS8886F

DS8888F9% RT reduction

71



IBM DS8950F Considerations for Consolidation

The DS8950F (40 core) increases Max IOPs by 2.5X over DS8870, and offers opportunities for consolidation

0

0.1

0.2

0.3

0.4

0.5

0.6

0 500 1000 1500 2000 2500

Re

spo

nse

Tim

e (

ms)

KIOPs


DS8950F

DS8886F

DS8870

1.38X

2.5X

72



Future MadeFuture Made

DS8900F Sequential Performance

73

0

20

40

60

80

GB

/s

Sequential Read – All Flash



DS8950F40 core

DS8950F20 core

DS8910F16 core

0

10

20

30

40

GB

/s

Sequential Write – All Flash




DS8950F40 core

DS8950F20 core

DS8910F16 core

Sequential throughput requirements during batch peaks especially when doing Copy Services is

typically what will determine a particular DS8000 configuration from a performance perspective



High Performance / High Capacity Flash Drive Performance

Performance figures are for a single RAID6 array

High Capacity Flash has similar sequential read but worse sequential write than High Performance FlashWrite performance is lower for the larger drives

High Capacity Flash has similar random read but worse random write than High Performance FlashWrite performance is lower for the larger drives

74

0

1

2

3

4

5

6

7

Sequential Read Sequential Write

GB

/s

Sequential Read/Write GBs

High Performance Flash

3.8 High Capacity Flash



0

20

40

60

80

100

120

140

160

180

4KB Random Read 4KB Random Write

KIO

ps

4 KB Read/Write IOPs

High Performance Flash






DS8900F 32Gb vs 16Gb HA – Sequential - CKD

0

1000

2000

3000

4000

5000

6000

7000

Single HA Read Single HA Write

MB

ps

CKD/zHPF – Sequential Read/Write MB/s

32 GFC 16 GFC2x increase in both read/write bandwidth

75



DS8900F 32Gb vs 16Gb HA – IOPs - CKD

0

50

100

150

200

250

Single HA Read Single HA Write

KIO

ps

CKD/zHPF - 4 KB Read/Write IOPs

32 GFC 16 GFC

76



DS8900F 32Gb vs 16Gb HA – Port Latency - CKD

0

0.02

0.04

0.06

0.08

0.1

0.12

4KB Single Port Read 4KB Single Port Write

Respo

nse T

ime (

msec)

CKD/zHPF - 4 KB Read/Write Base Latency (Server to DS8900F)

32 GFC

16 GFC

77



DS8900F 32Gb vs 16Gb HA – Sequential - Open

0

1000

2000

3000

4000

5000

6000

7000

Single Port Read Single Port Write Single HA Read Single HA Write

MB

ps

Open - Read/Write MB/s

32 GFC 16 GFC2x increase in both read/write bandwidth

78



DS8900F 32Gb vs 16Gb HA – IOPs - Open

0

50

100

150

200

250

300

350

400

450

500

Single Port Read Single Port Write Single HA Read Single HA Write

KIO

ps

Open - 4 KB Read/Write IOPs

32 GFC 16 GFC

1.6X

79



0

0.02

0.04

0.06

0.08

0.1

0.12

0.14

0.16

0.18

4KB Single Port Read 4KB Single Port Write

Re

sp

on

se

Tim

e (

ms

ec

)4 KB Read/Write Base Latency (Server to DS8900F)

32 GFC 16 GFC

DS8900F 32Gb vs 16Gb HA – Port Latency - Open

80



0

2

4

6

8

10

12

14

16

18

20

1 Path 2 Paths 2 HA 4 Paths 4 HA 8 Paths 8 HA

GB

/se

c

Sequential Write / zHPF – MMDS8950F 40 Core – 8 HPFE Gen2

DS8950F (32GFC)

DS8950F (16GFC)

DS8900F Metro Mirror Bandwidth

81



0

50

100

150

200

250

300

350

400

450

500

No Workload Moderate Workload Heavy Workload

Reb

uild

Rate

(M

B/s

)

Single Rank Rebuild (RAID-6)

Smart Rebuild Regular Rebuild

RAID-6 Smart Rebuild

82

• Smart Rebuild for HPFE Gen 2

• Predictive failure of Flash card prompts cloning of data while still online (RAID 1 relationship), eliminating RAID rebuild

• Cloning reduces duration of rebuild time

• Falls back to RAID rebuild if necessary if Flash card were to fail

• RAID 6 support only

• The rebuild rate (Smart and Regular Rebuild) is equivalent for HPF and HCF



Questions

83

ds8900f r9.0 accelerate with ibm storage update · 2019-12-09 · ds8910f flexibility class and...

Documents