Re: Restricting ports/services to specific interfaces

[mkrouse@xxxxxxxxxxxxxxx]

Simon,

I believe I'm not explaining the problem very well - or perhaps subnets is
the answer and I'm just not getting it.

I should probably also mention that I believe the root of the problem lays
with the bridges/routers, possibly frame type conversion issues. But they
are IBM ones no longer being made, no one here knows much about them, and
the company that installed and configured them is kaput. (They are budgeted
for replacement next year, until then we're holding our breath).  So
anyway, I'm trying to resolve the problem by forcing the AS/400 to behave
differently.

To answer some of your questions...

**>If just the T/R interface is active - the DHCP traffic goes in/out
through
**>it using it's IP address (in LLC format) and the PC's get their IP
**>addresses and everything works fine.

**Yes.  Only one interface is active so how else would you expect it to
work?

I would expect it to work on the active interface.  The problem is that it
only works on the one active interface if that one is the T/R interface, if
it's the ethernet interface it doesn't work, if both are active (which is
what I need) it doesn't work.

**>If Ethernet and T/R interfaces are both active - DHCP requests are
**>received on both interfaces, but the responses only go out the Ethernet
**>interface (in ETHV2 and 802.3 format) and the PC's don't get IP
addresses.

**That's because they are on the same subnet and you can't choose which
**interface will be used.  TCP thinks it can reach your PCs by either
**interface so it picks one.

Yes, they are on the same subnet, but it can reach the PC's by either
interface, so shouldn't it be appropriate for them to be on the same
subnet?  DNS works, ping works, ARP works, telnet works, everything but
DHCP works.

**                          I suspect your ethernet interface is either
**started first or has a lower IP address.  Both those factors can affect
**which interface is used but neither is reliable.

I tried altering both the IP address & the start sequence, it didn't help.

**>I would like to force DHCP to use the T/R interface (or that IP address)
**>as it seems that would solve the problem.

**Subnetting is how you do that!

I gave an interface on the T/R line a different subnet mask.  Every PC
beyond the bridges/routers which has a static IP address (there are many -
we use it to control Internet access) abruptly quit communicating.  As soon
as I deactivated the interface, they started again.  Perhaps, I did it
wrong.