Re: Restricting ports/services to specific interfaces

h
mkrouse@co.ottawa.mi.us wrote:
>I believe I'm not explaining the problem very well - or perhaps subnets is
>the answer and I'm just not getting it.

>I should probably also mention that I believe the root of the problem lays
>with the bridges/routers, possibly frame type conversion issues. But they
>are IBM ones no longer being made, no one here knows much about them, and
>the company that installed and configured them is kaput. (They are budgeted
>for replacement next year, until then we're holding our breath).  So
>anyway, I'm trying to resolve the problem by forcing the AS/400 to behave
>differently.

DHCP cannot be routed unless you configure relay agents on the routers.
Perhaps that is part of your problem but I suspect it is more fundamental.

>I would expect it to work on the active interface.  The problem is that it
>only works on the one active interface if that one is the T/R interface, if
>it's the ethernet interface it doesn't work, if both are active (which is
>what I need) it doesn't work.

That's because your TCP configuration is stating that either interface can
be used to reach any device in your network.  That simply isn't true unless
you have both Token Ring and Eternet cards in every PC.  They may be part of
the same LOGICAL network but they are on separate PHYSICAL networks.  They
only join the logical network when you assign an IP address.  Since some
devices don't get an IP addres until DHCP supplies it -- catch-22.  Once you
have IP addresses at each device and a bridge of some sort then you can
reach any device on the network but something is bridging the two physical
networks.

>Yes, they are on the same subnet, but it can reach the PC's by either
>interface, so shouldn't it be appropriate for them to be on the same
>subnet?  DNS works, ping works, ARP works, telnet works, everything but
>DHCP works.

The Token Ring network cannot be reached from the Ethernet network except
via a bridge which is physically connected to both networks.  The 'bridge'
could be a router, a server, another PC, or your AS/400 since it has the
physical requirements (both a TR and Eth card).

The non-DHCP stuff only works once the TCP stack is active on the PC.  TCP
is not properly active until it has a valid IP address.  DHCP is sending the
requested IP address on to the Eth network but nothing there wants it and
there is no relay agent configured to forward it to the TR network.

>I tried altering both the IP address & the start sequence, it didn't help.

As I said, it's not a reliable way of controlling which interfacec is
actually used.

>I gave an interface on the T/R line a different subnet mask.  Every PC
>beyond the bridges/routers which has a static IP address (there are many -
>we use it to control Internet access) abruptly quit communicating.  As soon
>as I deactivated the interface, they started again.  Perhaps, I did it
>wrong.

All devices on the same subnet need the same subnet mask.  What you did was
put the AS/400 on a new separate network thus without appropriate routing
information the devices don't know how to reach the AS/400.

You can only achieve your desires by reconfiguring your network.  Either
configure a relay agent on the Eth network to forward DHCP responses to the
TR network or chnage the addressing scheme used on one of the networks.

Since the TR network is the one you want to use DHCP on I suggest that is
the one you change.  The easiest method is to assign another range of IP
addresses to the TR network.  For example if your current network is using
192.168.0.nnn addresses then change the TR network to use 192.168.1.nnn
addresses.  Configure DHCP to serve addresses in that range.  Configure any
devices that use static IP addresses to use ones in that range also
(although you can get DHCP to serve a specific address to a specific device
via its MAC address so you could use DHCP for everything as long as your
DHCP server is up when those devices boot).  You will also need to
reconfigurh whatever device is bridging the TR and Eth networks although
that may be taken care of automatically by assigning a new address to the TR
interface on that device.  Of course, this will be complicated if you use IP
addresses that are routable via the internet

You cannot do what you want without some network reconfiguration and that is
not something to embark on lightly.  PLAN!!!!

If your IBM routers are 2210s or similar then they can be configured with a
GUI.  Find the CDs that came with the devices and load the configuration
program.  Or download it from www.networking.ibm.com.  You will find the
manuals at the same site in PDF form and they are on the CD.  Those routers
support DHCP, relaying, bridging, and much else.  I have two of them here
and managed to configure them without too much trouble (at least the real
network -- PPP dial-in was troublesome).  You can suck the current
configuration off the routers, save it, modify it, and send it back.  If you
stuff it up then send the saved original and you'll be back where you were
(as long as you don't lose the network interface in which case you'll have
to use the service port cable to set up the network interface and then send
the configuration).

Regards,
Simon Coulter.

«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»
«» FlyByNight Software         AS/400 Technical Specialists       «»
«» Eclipse the competition - run your business on an IBM AS/400.  «»
«»                                                                «»
«» Phone: +61 3 9419 0175   Mobile: +61 0411 091 400        /"\   «»
«» Fax:   +61 3 9419 0175   mailto: shc@flybynight.com.au   \ /   «»
«»                                                           X    «»
«»               ASCII Ribbon campaign against HTML E-Mail  / \   «»
«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»