Informix Shared Storage Architecture and Solaris IPMP Hardening

Running high-performance database cluster software (such as Informix) across corporate enterprise data centers (such as shared data clusters in east-dc1 or west-dc1) requires ultra-low latency storage access and total network resilience. Relying on basic journaled filesystems introduces severe I/O caching overhead, and unclustered physical network interface cards create single points of failure.

In this systems engineering masterclass, I explore how to provision bare-metal Informix shared raw storage slices, assign persistent Solaris IPMP network failover groups, manage non-global zone IPMP propagation, and apply Enterprise Sun Security (JASS) hardening rules.

---

Part 1: Provisioning Informix Shared Raw Disk Slices

Unlike traditional application databases that write data tables into journaled filesystems (ZFS or UFS), Informix database server clusters achieve maximum transactional speed by writing straight to raw block storage slices (/dev/rdsk/*).

# Display attached SCSI raw disk storage arrays
ls -lah /dev/rdsk/c*t*d*s* | more

1. Formatting Logical Slices (format)

Invoke the Solaris disk utility menu to map out identical raw partition slice maps across primary and backup database cluster nodes:

# Launch interactive disk slicing formatting menu
format

Verify slice assignments and create explicit symbolic loop links pointing to raw character devices to prevent partition numbering drift:

mkdir -p /opt/informix/raw/
ln -s /dev/rdsk/c0t3d0s3 /opt/informix/raw/datadb_chunk1
chown -R informix:informix /opt/informix/raw/
chmod 600 /opt/informix/raw/*

---

Part 2: Configuring Solaris IP Network Multipathing (IPMP)

To ensure automatic network link recovery during ethernet switch outages, combine physical network cards (such as bge0 and bge1) into active backup IPMP failover groups inside /etc/hostname.*.

vi /etc/hostname.bge0

# Primary physical interface persistent initialization definition
primary-server netmask 255.255.255.0 broadcast + group production_group up

Configure your fallback physical interface /etc/hostname.bge1 to act as a dedicated failover standby link:

vi /etc/hostname.bge1

# Redundant IPMP standby connection definition
test-address netmask 255.255.255.0 broadcast + group production_group standby up

---

Part 3: Establishing IPMP Redundancy in Non-Global Zones

When propagating highly available network access down into non-global container zones, bind zone configurations to the parent global host IPMP failover group.

zonecfg -z informix-zone

zonecfg:informix-zone> add net
zonecfg:informix-zone:net> set address=10.10.10.155/24
zonecfg:informix-zone:net> set physical=bge0
zonecfg:informix-zone:net> end
zonecfg:informix-zone> verify
zonecfg:informix-zone> commit
zonecfg:informix-zone> exit

If active link failure drops physical hardware bge0, the underlying Solaris kernel automatically shifts all bound container traffic over to fallback link bge1 instantly without dropping active database connections.

---

Part 4: Solaris Base Security Hardening (JASS)

To lock down bare-metal Solaris installations against perimeter security vulnerabilities, deploy the JASS (JumpStart Architecture and Security Scripts) toolkit.

# Verify JASS automation script library packages
cd /opt/SUNWjass/files/

Apply secure baseline security hardening profiles to disable obsolete cleartext transmission daemons and lock down kernel parameters:

# Execute standalone security audit lockdown pass
/opt/SUNWjass/bin/jass-execute -d secure.driver

References

• Informix High-Performance Raw Slice Configuration Manual
• Sun Oracle Enterprise Solaris IPMP Administration Architecture