...
A list of the various LCLS, LCLS-II, FACET, and Test Facilities gateways managed by EED Systems Group.
| Name | Purpose | PVs served | Host | CAS port | Beacon Port | Beacon sent to | Document/Comment |
LCLS | |||||||
| gwEbeamServe | Serving LCLS PVs (Ebeam) to Photon | Readonly Write for selected PVs | lcls-daemon3 | 5080 | 5081 | 172.21.40.63 (Photon Gateway Subnet) | Allow all Deny OTRS:DMP1:695:.* |
| gwEbeamServeWF | Serving LCLS PVs (Ebeam) to Photon | Readonly Write for selected PVs | lcls-daemon3 | 5079 | 5081 | 172.21.40.63 (Photon Gateway Subnet) | Deny all Allow OTRS:DMP1:695:.* (dedicated to serve XTCAV OTRDMP camera image PV) |
| gwLCLS4FACET | Serving LCLS PVs to FACET | Readonly | lcls-daemon10 | 5070 | 5069 | 172.27.75.255 (FACETCA) | |
| gwLCLS4LCLSII | Serving LCLS PVs to LCLS-II | Read and Write | lcls-daemon10 | 5060 | 5069 | 172.27.131.255 ( LCLS2IOC) and 172.27.11.255 (MCCSRV | |
| gwLCLSPUB | Serving LCLS PVs to public | Readonly | lcls-prod01 | 5068 | 5069 | 134.79.151.255 (DMZ) | |
| gwLCLSARCH0 | Serving LCLS and LCLS-II PVs to Archiver on DMZ | Readonly | lcls-prod01 | 5076 | 5069 | 134.79.151.255 (DMZ) | .* ALLOW (default) Deny a list refer gwLCLSARCH*.dat
|
| gwLCLSARCH1 | Serving LCLS and LCLS-II PVs to Archiver on DMZ | Readonly | lcls-prod01 | 5077 | 5069 | 134.79.151.255 (DMZ) | .* DENY Allow portion in the list refer gwLCLSARCH*.dat |
| gwLCLSARCH2 | Serving LCLS and LCLS-II PVs to Archiver on DMZ | Readonly | lcls-prod01 | 5078 | 5069 | 134.79.151.255 (DMZ) | .* DENY Allow portion in the list refer gwLCLSARCH*.dat |
| gwLCLSARCH3 | Serving LCLS and LCLS-II PVs to Archiver on DMZ | Readonly | lcls-prod01 | 5079 | 5069 | 134.79.151.255 (DMZ) | .* DENY Allow portion in the list refer gwLCLSARCH*.dat |
LCLS-II | |||||||
| gwLCLSII4LCLS | Serving LCLS-II PVs to LCLS | Read and Write | lcls2-daemon10 | 5060 | 5069 | 172.27.3.255 ( LCLSIOC) and 172.27.11.255 (MCCSRV) | |
FACET | |||||||
| gwFACET4LCLS | Serving FACET PVs to LCLS | Readonly | facet-daemon1 | 5070 | 5069 | 172.27.11.255 (LCLSCA) | |
| gwFACETPUB | Serving FACET PVs to public | Readonly | lcls-prod01 | 5063 | 5069 | 134.79.151.255 (DMZ) | Design |
| gwEXP2FACET | Serving Fedora based PCOEdge Camera PVs in B244 to FACET controls | Readonly Write allowed from facet-srv20 to slac-dev-fed | lcls-prod01 | 5062 | 5069 | facet-srv*: 172.27.72.28 172.27.72.22 172.27.72.23 | Not in use currently |
| gwFACETARCH | Serving FACET PVs to Archiver on DMZ | Readonly | lcls-prod01 | 5075 | 5069 | 134.79.151.255 (DMZ) | Allow all
|
| Test Facilities | |||||||
| gwACCTESTPUB | Serving Test Facilities PV to public | Readonly | testfac-daemon2 | 5048 | 5049 | 134.79.219.255 (LCLSDEV) | doc |
...
/etc/init.d/st.gwLCLSPUB on lcls-prod01 to use CMDPATH=/afs/slac/g/lcls/tools/gateway/script/st.gwLCLSPUB64Restart gateway:
| Code Block | ||||
|---|---|---|---|---|
| ||||
[laci@lcls-prod01]$ /etc/init.d/st.gwLCLSPUB restart |
lclshome on LCLSDEV/LCLSDMZ nodes (e.g., mcclogin).gwLCLSARCH0:
| Note | ||
|---|---|---|
| ||
Archiver Gateways should be stopped and restarted one at a time to independently verify that ACLs are working properly. |
/etc/init.d/st.gwLCLSARCH0 on lcls-prod01 to use CMDPATH=/afs/slac/g/lcls/tools/gateway/script/st.gwLCLSARCH0_64Restart gateway:
| Code Block | ||||
|---|---|---|---|---|
| ||||
[laci@lcls-prod01]$ /etc/init.d/st.gwLCLSARCH0 restart |
Verify that LCLSIOC and LCLS2IOC PVs except for the following that the PV patterns are being archived in the LCLS Archiver according to the permissions below:
| Code Block | ||||||
|---|---|---|---|---|---|---|
| ||||||
[laci@lcls-prod01]$ cat $TOOLS/gateway/config/gwLCLSARCH0.dat ... # allow everthing, deny patterns EVALUATION ORDER ALLOW, DENY .* ALLOW ^[A-Za-z0-9]+:UND1:.* DENY ^[A-Za-z0-9]+:LTU1:.* DENY ^[A-Za-z0-9]+:LTU0:.* DENY ^[A-Za-z0-9]+:DMP1:.* DENY ^[A-Za-z0-9]+:IN20:.* DENY ^[A-Za-z0-9]+:BSY0:.* DENY ^[A-Za-z0-9]+:BSYA:.* DENY ^[A-Za-z0-9]+:MCC0:.* DENY ^[A-Za-z0-9]+:SYS0:.* DENY ^[A-Za-z0-9]+:LR20:.* DENY ^[A-Za-z0-9]+:NEH:.* DENY ^[A-Za-z0-9]+:NEH1:.* DENY ^[A-Za-z0-9]+:FEH:.* DENY ^[A-Za-z0-9]+:FEH1:.* DENY ^[A-Za-z0-9]+:FEE1:.* DENY ^[A-Za-z0-9]+:SYS2:.* DENY ^[A-Za-z0-9]+:CLTH:.* DENY ^[A-Za-z0-9]+:GUNB:.* DENY ^[A-Za-z0-9]+:LGUN:.* DENY ^[A-Za-z0-9]+:ALH2:.* DENY ^[A-Za-z0-9]+:ALH0:.* DENY ^[A-Za-z0-9]+:ACR0:.* DENY ^[A-Za-z0-9]+:GBL0:.* DENY ^[A-Za-z0-9]+:R02:.* DENY ^[A-Za-z0-9]+:XRT1:.* DENY |
gwLCLSARCH1:
| Note | ||
|---|---|---|
| ||
Archiver Gateways should be stopped and restarted one at a time to independently verify that ACLs are working properly. |
/etc/init.d/st.gwLCLS4LCLSIIgwLCLSARCH1 on lcls-daemon10 to use CMDPATH=/usrafs/slac/localg/lcls/tools/gateway/script/st.gwLCLS4LCLSIIgwLCLSARCH1_64Restart gateway:
| Code Block | ||||
|---|---|---|---|---|
| ||||
[laci@lcls-prod01]$ /etc/init.d/st.gwLCLS4LCLSIIgwLCLSARCH1 restart |
Verify
that LCLS PVs can be seen from LCLS2IOC subnet clients....
that the PV patterns are archived in the LCLS Archiver according to the permissions below:
| Code Block | ||||
|---|---|---|---|---|
| ||||
[laci@lcls-prod01]$ cat $TOOLS/gateway/config/gwLCLSARCH1.dat
...
# deny everything, allow the patterns
# For every allow pattern here, we should have a deny pattern in gwLCLSARCH0.dat; otherwise we'll get duplicate PVs
EVALUATION ORDER DENY, ALLOW
.* DENY
^[A-Za-z0-9]+:UND1:.* ALLOW
^[A-Za-z0-9]+:LTU1:.* ALLOW
^[A-Za-z0-9]+:LTU0:.* ALLOW
^[A-Za-z0-9]+:DMP1:.* ALLOW
^[A-Za-z0-9]+:IN20:.* ALLOW
^[A-Za-z0-9]+:BSY0:.* ALLOW
^[A-Za-z0-9]+:BSYA:.* ALLOW
GWLCLSARCH1:.* ALLOW |
gwLCLSARCH2:
/etc/init.d/st.gwLCLS4LCLSII on lcls-daemon10 to use CMDPATH=/usr/local/lcls/tools/gateway/script/st.gwLCLS4LCLSII_64Restart gateway:
| Code Block | ||||
|---|---|---|---|---|
| ||||
[laci@lcls-daemon10]$ /etc/init.d/st.gwLCLS4LCLSII restart |
...