Subject: Re: SSL and Firewall Fun

["Steve Glanstein" <mic@xxxxxxxxx>]

Hello Simon et al:

Thanks for the response...let me recap problem and the two solutions that I
found...

Here's the problem...

First, assume a good SSL setup and latest service pack...which I have.

The first connection for any new environment goes to port 8476 to obtain
information about the "host" AS/400.

After it goes there once, it never needs to repeat the process.

Thus, when we tested PC1 PRIOR to enabling any host filter rules, client
express worked. We connected to ports 9470+ and everything looked good.

After the filter rules were enabled, PC1 still continued to work.

We installed Client Express with SSL on PC2. It was unable to connect using
SSL. The host (in our case, the AS/400) has a journal called QIPFILTER which
we used to log rejected TCP/IP requests. This journal showed port 8476 as a
"DENY."

Spoke to some IBMers yesterday...turns out one other person in the country
had this problem and their solution was to enable to non-SSL port...which is
unacceptable!

It turns out that you can defeat this problem two ways: One way is to make a
registry update to provide the version and release number to the
environment.

A simple Batch file that does the following will "fool" the computer...

REGEDIT4

[HKEY_CURRENT_USER\Software\IBM\Client Access
Express\CurrentVersion\Environments\My AS/400
Connections\NISSAN-HI.COM\Communication]
"Version Release Level"=dword:00040400

--------------------------------

The second way ... which appears even better is to use CWBBACK which backs
up the configuration to a couple of disk files. Then we use CWBREST to
restore the configuration to the newer computer. This appears to work.

--------------------------------

Thanks,

Steve Glanstein
mic@aloha.com