DataPower Refresh from physical to virtual

Introduction

This document provides a high-level overview of the DataPower migration project, also known as the DataPower Refresh project, and deals with migration from physical (hardware) DataPower appliances to virtual (VM, Docker, Linux service) DataPower form factor. This is not meant to be a step-by-step implementation guide but rather a list of topics to discuss and consider as part of a migration planning. The migration should be performed by a certified DataPower SME.

General

1. The process is recommended to be performed as lift and shift technique by migrating a whole appliance at a time rather than breaking it down into groups of services, applications, or application domains.
2. It is generally recommended to perform the migration without making any additional changes (firmware upgrades and etc). If required, work on these changes before the migration begins.
3. As the migration is performed between different DP appliance form factors, Secure Backup method can’t be used, therefore, the migration should utilize the Export/Import Configuration feature.

Review current DP implementation

1. Review architecture, network, HSM, and security implementation.
2. Review service implementation.
3. Check if there are any stateful services in use.
4. Review chained services.
5. Review any non-exportable configuration e.g. IPMI settings, local user accounts, cryptographic files in crypto folders, keytab and LTPA files, keys on HSM. Password Aliases might be missing as well depending on the Domain Settings for password handling.
6. Check if there are any custom files in the store folder.
7. Make sure all crypto files in use are available externally as these aren’t part of the configuration export. If files are missing, plan with the client generation and deployment of new files before the migration.
8. Check firmware version in use vs destination DP version requirements. Should firmware on the source DP be upgraded? Should firmware on the destination DP be downgraded?
9. If firmware upgrade required, check deprecated and removed features in the new version and if there is any impact on the current configuration.
10. Make sure optional modules used by current DP implementation are supported on the destination form factor DP appliance.

Devise migration plan

1. Plan the migration approach -  lift and shift vs coexistence.
2. Aim to avoid downtime (different techniques available for cluster and standalone implementations).
3. Plan how to remove DP from getting new workloads, consider the following scenarios:
• External clients initiate inbound connections to DP – direct or through NLB.
• DP initiates outbound connections for messaging, file transfer, and etc.
• External systems communicate with DP using non-application means.
• Cache and persistent connections.
• Quiesce.
4. Plan if any external to DP configuration should be addressed e.g. new IP addresses, NLB configuration, and etc.
5. Plan for firewall rule changes for inbound requests - API consumers, monitoring, jumpbox, DPOD, and etc.
6. Plan for firewall rule changes for outbound calls - API backends, LDAPs, monitoring,  DPOD, and etc.
7. Plan default domain migration.
8. If required, plan for destination DP appliances cloning.
9. Plan post migration testing strategy:
10. External clients initiate inbound connections to DP – direct or through NLB.
• How to tell if a transaction failed due to the migration?
• How to tell if an object down due to the migration?
11. Decide about the period of post migration support.
12. Review and sign of the migration plan and coordinate tasks with different teams.

Migration process

1. Make sure you have physical access to the old DP appliances.
2. Work according to the devised migration plan.
3. Upload crypto files.
4. Import configuration.
5. Sanity testing.
6. Regression testing.
7. Cut over to the target deployment.

Bibliography 

1. Webcast Replay: IBM DataPower Firmware Upgrades and Migration between Hardware Generations
2. Available modules by product
3. DataPower Gateway for Docker
4. Oracle data sources
5. IBM Support - Migrating a physical DataPower appliance to a virtual edition