Channel Access Gateway

1
Channel Access Gateway

• SLS Controls Pikett Training

2
What is a Channel Access Gateway?
CA client
CA server

• It forwards channel access to a different
  network.
• It allows access control and filtering.
• It can reduce network traffic (when well
  configured)
• It knows only channels, not records.

3
Reduction of network traffic

• Monitors from many clients to the same IOC are
  bundled.
• Saves bandwidth, memory and CPU time on IOC.
• IOC has to serve only one client the gateway.
• Already connected channels are not searched
  again.
• Reduces broadcasts when many clients read the
  same channel.
• Channels stay connected for at least two hours.
• Reduces broadcasts from short-lived clients
  (command line caget).

4
How to use the gateways?

• SLS machine and beamlines
• Gateway is used automatically within beamline or
  machine network.
• Office
• Type cam (channel access machine) to switch to
  machine gateway.This also gives access to
  beamlines via beamline gateways.
• Type cao (channel access office) to switch back
  to office.Here you get only test and simulation
  channels.
• Type caobla, caproscan, or cahipa for other
  machines
• xfellc
• OBLA gateway is used automatically

5
Gateway status screen

• medm -x gateways.adl
• (From office net, type cam first.)
• or SLS Launcher

Login button
2 gateways on one host
Channels in use
Not existing channels
6
Filtering and access control

• Filtering is done by channel name patterns.
• Only configured name patterns are forwarded.
• Blocked channels reduce broadcast traffic.
• Requires simple rules to know network from
  channel name.
• Wrong filter settings make channels unavailable.
• Access may be read-only or read-write.
• Filter rules can be combined with rules for users
  and hosts.
• Beamlines can write only to selected channels on
  machine.
• Beamlines cannot write to other beamlines.
• Wrong filter settings give wrong access rights.

7
Example configuration
EVALUATION ORDER ALLOW, DENY get machine and
other beamline channels X(?!12SA).
ALLOW ILUUL. ALLOW A.
ALLOW allow statistic
channels X12SA-IMPGW.
ALLOW X12SA-EXPGW. ALLOW Orbit
Feedback .-LBB. ALLOW
PLCs MIS, VCS, LAC .-MIS.
ALLOW .-VCS. ALLOW .-FE-.
ALLOW .-LAC.
ALLOW Special X12SA-VME-ID.
ALLOW X12SA-ID.
ALLOW WRITE ACOAU-ACCUOP-X12SA(\.VAL)?
ALLOW WRITE ACOAU-ACCUALARM-X12SA(\.VAL)?
ALLOW WRITE X12SA-FE-.CLOSE4BL(\.VAL)?
ALLOW WRITE X12SA-FE-.OPEN-BLMODE(\.VAL)?
ALLOW WRITE X12SA-FE-FI1WT_SET(\.VAL)?
ALLOW WRITE block everything but my own
status channels to my beamline IP to prevent
loops !X12SA-IMPGW. DENY FROM
129.129.122.14

• Filename GATEWAY.pvlist
• Filtering based on Perl regular expressions
• Install directory/usr/local/caGateway
• Copy on fileserver/exchange/home/zimoch/caGatewa
  y
• CVS repositoryG/EPICS/extensions/src/gateway/con
  figor short gateway/config

8
How can I see that a gateway has a problem?

• Start the gateway status medm screen
• It should work on any network. (office after
  cam)
• Records on other networks ...
• disconnect unexpectedly.
• Are gateway status channels disconnected? Try to
  restart gateway.
• take long to connect.
• update irregularly or delayed.
• Is the gateway CPU load high? Try to disconnect
  waveform clients.
• are unavailable. (Most probable error)
• Is the record new? Tell me. It might not match
  the filter pattern.
• Gateway does not accept any new clients? Try to
  restart gateway.

9
Where do the gateways run?

• Office/SLS (slscag02)
• WBGB server room, rack WBGB.137.05
• Beamlines/SLS (x-gw)
• WSLA.103 on beamline blade system
• The gateways are virtual machines!
• OBLA (fin-ccagw01e)
• OBLA / EG, rack OBLA.310.4
• Coming soon XFEL Injector (fin-ccagw01e ?)
• WBGB server room
• Virtual machine

10
How to restart a gateway?

• Tell control room and beamline what you are
  doing.
• All connections between machine and beamline will
  drop.
• From the machine network start gateway status
  screen.
• Click the login button of the gateway.
• Password is in envelope 2-B in Renes office.
• Optionally have a look at the gateway log file.
• /usr/local/caGateway//gateway.log
• Restart the running gateways.
• service caGateway restart

11
What to do if the virtual machine is dead?

• Only if login to x-cagw is not possible.
• Follow the instructions at https//wiki.intranet.p
  si.ch/Controls_IT/PikettVMwareHowTo
• Reset CA gateway virtual machine only!
• Avoid rebooting the VM host because this kills
  all virtual machines.
• x-gw beamline login gateway
• x-bpc beamline boot PC and rmc server
• x-softioc beamline soft IOC server