[Beginning of shutdown] PVA Site gateways

[Tom-Willemsen]

As a developer I would like to be able to access PVA PVs defined in the halls from my developer machine.

To do this we need a p4p site gateway.

Acceptance criteria

• From a machine in [r3/r55/r80/r2] I can access PVA PVs that are in another building (all permutations)

Notes

• Site gateways run on a control-svcs - credentials in usual place
• Be careful with firewall config, the firewall is necessary to prevent loops (& ensuing broadcast storms) on the existing channel access gateways
  • This ticket should be done at the beginning of a shutdown to minimise risk to instruments of fiddling with firewall configs
• Spun out from https://github.com/ISISComputingGroup/IBEX/issues/8309

Time in Planning

01:22:46 08/08/24

[ChrisM-S]

It would be good to assess the risk profile of doing this change

• How much can be done incrementally and predictably.
• How quickly we can identify if something has not gone right (or might become "non-right" unexpectedly!).
• What we might do/who might we notify if something does go wrong?
• Putting this through a Site CAB might be a wise move (not overly onerous) - but we could take advice on this from the Infrastructure team who run the server.
• Also doing at a network dev time might also be wise.
• Doing the changes from a console where network access is not needed (for the console access to work) would also probably be a good idea

[FreddieAkeroyd]

The risk is basically if the system firewall is turned off while the existing CA gateways are running, then scripts running on instruments will see multiple mirrored PVs and some may hang/crash. This is not a broadcast storm or anything that will affect non-epics systems, and i think only affects running scripts (and would be obvious). We need to add some new rules for PVA, so there should be no risk of breaking the existing system, and if we shutdown the CA gateways first then the change can be done safely and even if issues, doing out of cycle should mean no important running instrument script is interrupted. We didn't do it in cycle as shutting down the central gateways stops central beam pvs (shutter, moderators) and so interrupts experiments