Re: Client Access to VPN'd system

this is CAE info apar on vpn support from CA Home Page Apars
http://www-1.ibm.com/servers/eserver/iseries/clientaccess/caiixe1.htm

APAR#: II11791
Component: INFOAS400 - AS/400 Information
Release(s): R440

Abstract
CLIENT ACCESS EXPRESS SUPPORT POSITION ON VPN CONNECTIVITY


Error Description
** Last updated December 4, 2000 **

Client Access Express now supports connections to
AS/400 systems with a VPN connection.  The following
software is required for a supported connection:

- Client Access Express (V4R4M0 or later) running on a
 Windows 2000 platform
- AS/400 must be at V4R5 or later

As of this writing, testing has only been done on the
Windows 2000 platform.  This is because it is the only one
that has VPN client support built in that is compatible with
the AS/400.  If third-party VPN client support becomes
available on other platforms (Windows 95, 98, Me, NT 4.0),
it may work, but it is not supported at this time.  VPN
clients must support the L2TP protocol to interoperate with
the AS/400.

The type of scenario that is supported is documented in
the redpaper entitled "Remote Access to AS/400 with
Windows 2000 VPN clients" (REDP0036).  (View this redpaper
online at http://www.redbooks.ibm.com).  Similar
information is also located in the redbook "AS/400 Internet
Security Scenarios: A Practical Approach", SG24-5954.  View
the PDF version of this redbook at:
 http://www.redbooks.ibm.com/pubs/pdfs/redbooks/sg245954.pdf
See Chapter 12, "Remote Access with Windows 2000 VPN clients".
As of this writing, the redbook has later updates than the
redpaper.  It is highly recommended that users read this
redbook or redpaper before attempting a VPN connection,
since detailed configuration information is included.

Another good source of information is located in the Technical
Studio.  There is an article called "Set Up a VPN (Virtual
Private Network) to Securely Manage Your AS/400 Across the
Internet".  It can be viewed at:
 http://www.ibm.com/as400/tstudio/vpn/index.htm

All functions of Client Access Express that work on
Windows 2000 should work in this environment.  For
information on general support of Windows 2000, please
refer to Information APAR II11853.


----- Original Message -----
From: "Vernon Hamberg" <vhamberg@attbi.com>
To: <midrange-l@midrange.com>
Sent: Tuesday, March 26, 2002 5:47 PM
Subject: Re: Client Access to VPN'd system


> Just some random thoughts:
>
> 1. Is the 400 on the 192.168.0.0 subnet? If not, you'll need gateways set
> up on your Windows machine, I think.
> 2. I used to work where we connected with VPN and then used, I don't know,
> Rumba and/or WRQ Reflection. No problem.
> 3. CA, no matter what version, WILL want a HOSTS file, IIRC.
> 4. The 400's got to be in the same network as you are, or reachable with a
> next hop/gateway.
> 5. Port should not matter, IMO.
>
> At 04:57 PM 3/26/02 -0500, you wrote:
> >Using CA v3r2 to access several systems.  I am using CA v3r2 vs. CAE
because
> >of lowest common denominator factors.
> >
> >Our shop also uses ViewNow, which is able to connect to remote AS/400s
thru
> >a VPN setup.  In ViewNow, I set up a session with an internal IP address
> >like 192.168.x.xx and port 8045.
> >
> >CA v3r2, when setting up a connection, it only asks for the IP address.
> >Obviously, it's not going to find a 400 at that address.  Strangely
enough,
> >the client (Personal Communications WorkStation Program) gives the
> >opportunity to specify a port (and I see this in the session.WS file as
> >well) via the Communication menu, then Configure option.  On a whim, I
> >change the port number from the default 23 to 8045.  But this doesn't
work;
> >no connect.
> >
> >Is this beyond the capabilities of CA v3r2?  Or is there a tweak I
missed?
> >I trust CAE can do this?
> >
> >Dan Bale
> >SAMSA, Inc.
> >989-790-0507
> >DBale@SAMSA.com
> >   Quiquid latine dictum sit altum viditur.
> >   (Whatever is said in Latin seems profound.)
> >
> >
> >_______________________________________________
> >This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> >To post a message email: MIDRANGE-L@midrange.com
> >To subscribe, unsubscribe, or change list options,
> >visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
> >or email: MIDRANGE-L-request@midrange.com
> >Before posting, please take a moment to review the archives
> >at http://archive.midrange.com/midrange-l.
>
> _______________________________________________
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> To post a message email: MIDRANGE-L@midrange.com
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
> or email: MIDRANGE-L-request@midrange.com
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>