RE: Netserver browsing across firewall zones

Does the as400 have a route back to the inside network?  While you are
allowing INSIDE to DMZ connection, if the server does not know how to
reply to something not on it's subnet, you will not get your connection.


Chris Bipes
Information Services Director
CrossCheck, Inc.

-----Original Message-----
We have 3 iSeries boxes that do a limited amount of Netserver file
serving
to a few users.  The users are all on the 'inside' firewall zone as well
as
2 of the 3 iSeries boxes.  The users can pull up the domain when
browsing
down through the network and see those 2 boxes just fine.  The 3rd box
is
in our 'DMZ' firewall zone and doesn't show up when browsing the domain
(It
is also a member of the same domain).
The netserver is set to announce it's name every 5 minutes (via Netbios
broadcasts I believe).  I suspect this is just a matter of the
broadcasts
not getting across the firewall into the inside zone because the correct
ports aren't open.  I've tried opening up the inside zone to ports 137,
138, 139 from that particular iSeries in the DMZ with no luck so far.
Any
ideas?  Any example of the PIX commands follows:

access-list inside permit udp any host 172.#.#.# eq netbios-dgm
access-list inside permit udp any host 172.#.#.# eq netbios-ns
access-list inside permit udp any host 172.#.#.# eq 139