RE: Connecting an AS400 to the Internet

[Buck Calabro <mcalabro@xxxxxxxxxxxx>]

On Thursday, May 14, 1998 12:30 PM, Vernon Hamberg 
[SMTP:hambergv@goldengate.net] wrote:
-snip about hooking the /400 to the 'net */

> Security is a problem here, because any of these addresses you assign
> internally are visible to the big, bad, Internet. You need a router that
> can do some kind of packet filtering, at the least. Your ISP should be
> able
> to help here, too. True firewalls/proxy/SOCKS servers are better but
> more
> complex. The basic premise is to block all traffic, then open your net
> up
> to known, trusted sources.
>
> With this kind of setup, our internal users have access to the Internet.
> And someone like me can get to the 400, e.g., by connecting with my own
> ISP. All I need is the address of the 400. Client Access' PC5250
> emulation
> uses telnet protocol, so it's a natural for this. This emulation is one

I'm completely green when talking TCP/IP, so I may be all wet, but doesn't 
your ISP at home assign you a dynamic IP address?  Doesn't this mean that 
in order to reach the /400 from your ISP that your firewall needs to allow 
traffic from *any AOL.COM IP address?

Is it the proxy server that identifies *you as opposed to 
joefishbreath@aol.com?

One customer has set up a RAS server on his NT box.  NT is on the 'net, 
and once you've signed on to RAS/VPN and have been validated as a known 
user, RAS passes my (validated) packets on to the internal network where 
the AS/400 resides.  Did I understand that right?


Buck Calabro
Commsoft, Albany, NY
mailto:mcalabro@commsoft.net

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---