Re: want to allow easy home access to iSeries

[Jim Oberholtzer <midrangel@xxxxxxxxxx>]

Nothing.  Start a VPN session with the firewall!

--OR--

On your IBM i, set up VPN in the IP policies under Network in System i 
Navigator.  At least the transmission will be encrypted that way.

--OR--

Short of that, set up packet rules on your IBM i that only allows telnet 
to a specific address if it is not in the local subnet.  That's done in 
System i Navigator.  (I don't think the packet rules are available on 
the web version at this point)

Options 2 & 3 are bad solutions compared to the VPN which should be a 
snap to set up on your firewall.

Jim Oberholtzer
Chief Technical Architect
Agile Technology Architects


On 10/4/2011 9:54 AM, Burns, Bryan wrote:
> Mochasoft advocates:
> What needs to be done on the IBM i and the firewall to allow a Mochasoft
> emulator to be used without "opening the IBM i to the entire internet"?
> Bryan
>
> -----Original Message-----
> From:midrange-l-bounces@xxxxxxxxxxxx
> [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Glenn Hopwood
> Sent: Friday, February 18, 2011 7:14 AM
> To: Midrange Systems Technical Discussion
> Subject: Re: want to allow easy home access to iSeries
>
> A second nod for MochaSoft. We've been using it for 100+ remote
> locations without any issues.
>
> Glenn
>
> On 2/18/2011 6:24 AM, Chamara Withanachchi wrote:
> > >  Hi,
> > >
> > >  Have you tried the MochaSoft TN5250 ActiveX version, I guess that will
> work
> > >  for you
> > >
> > >  http://www.mochasoft.dk/tn5250activex.htm
> > >
> > >
> > >  <http://www.mochasoft.dk/tn5250activex.htm>
> > >
> > >  On Fri, Feb 18, 2011 at 4:40 PM, Luke Gerhardt<lgerhardt@xxxxxxxxx>
> wrote:
> > >
> > > >>  Instead of juggling scores of VPN accounts, I am now tasked with
> looking
> > > >>  into setting up our iSeries to allow home access with*minimal*
> > > >>  installation or configuration of the end users' system.
> > > >>
> > > >>  I've tried setting up tn5250j as a Java applet on a web server on the
> > > >>  system, but keep getting a Java error regarding security, at which
> point
> > > >>  it leaves me with a gray screen only.  I feel like I'm close
> > > >>  there...but...it's just not finishing.  That seems like the ideal
> method
> > > >>  so far, as it requires only having Java installed and browsing to our
> > > >>  site.  I'm just testing in locally right now, and there is no SSL set
> up
> > > >>  on that webserver as yet.  The error I get is "PKIX path validation
> > > >>  failed".  I get it three times and then it blows up and dies.:(
> > > >>
> > > >>  I'm also considering forwarding a port to allow SSL secured telnet
> out
> > > >>  of our firewall and having the end users install tn5250j.  I don't
> like
> > > >>  that we would then be responsible to hand-hold them through
> installing
> > > >>  software, but if I can't get the applet method to work, then I need
> to
> > > >>  do something.
> > > >>
> > > >>  Installing iSeries Access is not a workable solution for us in this
> case.
> > > >>
> > > >>  Thoughts from others who have walked this path before?
> > > >>  --
> > > >>  This is the Midrange Systems Technical Discussion (MIDRANGE-L)
> mailing list
> > > >>  To post a message email:MIDRANGE-L@xxxxxxxxxxxx
> > > >>  To subscribe, unsubscribe, or change list options,
> > > >>  visit:http://lists.midrange.com/mailman/listinfo/midrange-l
> > > >>  or email:MIDRANGE-L-request@xxxxxxxxxxxx
> > > >>  Before posting, please take a moment to review the archives
> > > >>  athttp://archive.midrange.com/midrange-l.
> > > >>
> --