Connecting securely from IBM MobileFirst Platform Foundation on Bluemix to on-premises systems
Ajay Chebbi January 31, 2017
MobileFirst_Platform Bluemix IBM_Containers
Note: This blog post refers to MobileFirst server running on IBM Containers. For instructions for MobileFirst server running on Liberty buildpacks and Mobile Foundation Bluemix service (which also runs on Liberty buildpack), pl refer to this blog post
You are already aware of the IBM MobileFirst™ Platform Foundation on IBM® Containers offering that allows you to take a locally developed MobileFirst project and run it on IBM Bluemix®. This article demonstrates how to securely connect from the IBM MobileFirst Platform Foundation on IBM Containers to an on-premises data center by using the Virtual Private Network (VPN) Service on IBM Bluemix.
The IBM VPN Service provides a secure communication channel between your data center and the resources that are running in the IBM Containers. You can configure IBM MobileFirst Platform Foundation to access the Systems of Record (SoR) data securely from the on-premises data center via MobileFirst adapters.
Create a VPN service instance
- Log in to the IBM Bluemix environment and create an instance of the IBM VPN Service. You can create one instance of this service per Bluemix space.
- On the VPN Service console, select the types of containers that you need to associate the VPN Service with - Single Container or Container Groups.
- Create a VPN Site Connection configuration by specifying the Gateway IP of your data center within the enterprise. You also need to configure the Customer Subnet and a pre-shared secret to establish the connection.
Your VPN service instance on Bluemix is now configured.
Configuration for the on-premises data center
You must now configure the on-premises data center to work with the IBM VPN Service on Bluemix. You can install any of the standard IPSec clients on the on-premises gateway. Detailed steps of configuration for various clients are provided here.
When the on-premises data center and the IBM Bluemix VPN service are configured, a secure connection is established between the two endpoints. You can check the status of the connection either in the Bluemix VPN console or by executing ipsec statusall command on the data center.
Connecting to on prem systems from IBM MobileFirst Platform Foundation adapters
You can use the MobileFirst Studio or the MobileFirst Command Line Interface (CLI) to create MobileFirst adapters that can be deployed to the server. The adapters help to connect to the enterprise back-end system, and deliver data to or from the MobileFirst applications. The adapters can be built to connect either to a web-service or to a database available in the enterprise system. For more information, see building adapters, here.
To connect from the adapter to the enterprise system securely through the VPN service, provide the private IP address of the system in the connection information of the adapter. You can now build and deploy the adapter on the container, and perform request invocation from the MobileFirst application. The MobileFirst Platform Foundation Container is now enabled to work with an on-premises system within the enterprise through the VPN service.
Inclusive terminology note: The Mobile First Platform team is making changes to support the IBM® initiative to replace racially biased and other discriminatory language in our code and content with more inclusive language. While IBM values the use of inclusive language, terms that are outside of IBM's direct influence are sometimes required for the sake of maintaining user understanding. As other industry leaders join IBM in embracing the use of inclusive language, IBM will continue to update the documentation to reflect those changes.