RE: Management Central Pervasive

Thanks for the reply Sean, but this is why I am confused.  The only DNS
entry for ams400.ourdomain.com is the 172.x.x.x entry.  The 208.x.x.x
address is not in any DNS, there is no name attached to it.  The dropped
packet is not an outbound packet, it is an inbound packet sent from the
internal address of the AS/400 to the external address.

My guess (and it's only a guess) is that the application(running under WAS
Express) is pulling the external address from the URL as it's received.
Then when it tries to authenticate, instead of using default_host:449 or
127.0.0.1:449 it tries to use 208.x.x.x:449 and the authentication request
is routed out through the firewall(since we have no internal 208.x.x.x
address) and back in.

Does this make any sense?

Scott Ingvaldson
AS/400 System Administrator
GuideOne Insurance Group

-----Original Message-----
date: Wed, 6 Aug 2003 10:58:32 -0400
from: "Sean Porterfield" <sporter@xxxxxxxxxxxx>
subject: RE: Management Central Pervasive

I'll take a stab at this from the firewall perspective.  First, I'm going to
assume you're not really using NAT on the inbound connection but rather port
forwarding.  (i.e. the AS/400 doesn't think it's talking to 172.x.x.y - the
firewall address but z.z.z.z the client IP address.)

Then you look at the AS/400 itself.  From your packet that dropped, I guess
the AS/400 uses 449 to find out what port another service is using.  For
some reason it is doing it by name rather than IP address.  So it says
"what's the IP address for ams400.ourdomain.com?"  DNS server says
208.x.x.x.

Even if you weren't blocking the outbound packet, it probably would not
work.  As far as I know, you can't forward a connection back onto the LAN.
(At least I haven't been able to, and the docs I've read support that.)

Anyway, the solution should be on the AS/400 somewhere.  Do you have a host
table entry for ams400.ourdomain.com on the AS/400?  If so, what address?  I
think if you add one to 127.0.0.1 it may solve the problem.

Otherwise you need to fix your DNS so that internal clients get 172.x.x.x
when looking up ams400.ourdomain.com.

But I could be way off base.  :)
HTH

   
This message and accompanying documents are covered by the Electronic
Communications Privacy Act, 18 U.S.C. §§ 2510-2521, and contains information
intended for the specified individual(s) only. This information is
confidential. If you are not the intended recipient or an agent responsible
for delivering it to the intended recipient, you are hereby notified that
you have received this document in error and that any review, dissemination,
copying, or the taking of any action based on the contents of this
information is strictly prohibited. If you have received this communication
in error, please notify us immediately by e-mail, and delete the original
message.