RE: Management Central Pervasive

> From: Ingvaldson, Scott

> http://208.x.x.x:8110/servlet/McYpvPervasive it gets NATed to
> http://172.x.x.x:8110/servlet/McYpvPervasive  I receive the login dialogue
> box, fill in the user ID and PW and click OK.  The next entry in the
> firewall log is an INCOMING request from 172.x.x.x to 208.x.x.x that looks
> like this:
>
> Action:               Drop
> Service:              449
> Source:               172.x.x.x
> Destination:          208.x.x.x
> Protocol:             tcp
> Rule:                 69
> Source Port:          41772
>
> And the page times out.  Service 449 is the Server Mapper(as-svrmap) port.
>
> My questions are: If the webserver is talking to itself why does it route
> out and back in through the firewall?  Can't you define something so that
> the webserver understands that the request routed to it can be handled
> internally?


I'll take a stab at this from the firewall perspective.  First, I'm going to
assume you're not really using NAT on the inbound connection but rather port
forwarding.  (i.e. the AS/400 doesn't think it's talking to 172.x.x.y - the
firewall address but z.z.z.z the client IP address.)

Then you look at the AS/400 itself.  From your packet that dropped, I guess
the AS/400 uses 449 to find out what port another service is using.  For
some reason it is doing it by name rather than IP address.  So it says
"what's the IP address for ams400.ourdomain.com?"  DNS server says
208.x.x.x.

Even if you weren't blocking the outbound packet, it probably would not
work.  As far as I know, you can't forward a connection back onto the LAN.
(At least I haven't been able to, and the docs I've read support that.)

Anyway, the solution should be on the AS/400 somewhere.  Do you have a host
table entry for ams400.ourdomain.com on the AS/400?  If so, what address?  I
think if you add one to 127.0.0.1 it may solve the problem.

Otherwise you need to fix your DNS so that internal clients get 172.x.x.x
when looking up ams400.ourdomain.com.

But I could be way off base.  :)
HTH