3.6 Remote Support Assistance By using the Remote Support Assistance (RSA), the customer can start a secure connection  from FlashSystem 900 to IBM when problems arise. An IBM remote support specialist can  then connect to the system to collect system logs, analyze a problem, run repair actions  remotely (if possible), or assist the client or an IBM SSR who is onsite. Important:  IBM encourages all customers to use the high-speed remote support solution  that is enabled by RSA. Problem analysis and repair actions without a remote connection  can get more complicated and time-consuming. Because the RSA uses a high-speed internet connection, customers can start an outbound  Secure Shell (SSH) call to a secure IBM server. Firewall rules might need to be configured at  the customer’s firewall  to allow the FlashSystem 900 Cluster and Service IPs to establish a  connection to the IBM Remote Support Center by using SSH. Note:  The type of access that is required for a remote support connection is outbound port  TCP/22 (SSH) from the FlashSystem 900 Cluster and Service IPs. The RSA consists of FlashSystem 900 internal functions with a set of globally deployed  supporting servers. Together, they provide secure remote access to the FlashSystem 900  when necessary and when authorized by the customer’s personnel. The remote support mechanism that features the following major components is shown in  Figure 3-2: The Remote Support Client is a software component that is inside FlashSystem 900 and  manages remote support connectivity. It relies only on a single outgoing Transmission  Control Protocol (TCP) connection, and it cannot receive inbound connections of any kind.  The Remote Support Client is controlled by using CLI or the GUI.  Front Servers are on an IBM Demilitarized Zone (DMZ) of the internet and receive  connections from the Remote Support Client and the IBM Remote Support Center Back  Server. Front Servers are security-hardened machines that provide a minimal set of  services, such as maintaining connectivity to connected Clients and to the Back Server.  They are strictly inbound, and never start a process on their own accord.  GLYPH<SM590000> Remote Support Center Front Server (internet) GLYPH<SM590000> Remote Support Client (machine internal) Figure 3-2 Remote Support Assistance without Proxy 84  Implementing IBM FlashSystem 900 Model AE3