Re: ACS 5250 VPN Issues

One of our customers is suffering with remote programmers and VPN connections, and the issue affects 5250 , Database connections and FTP. They use Fortinet with Deep Packet Inspection, as Larry suggests, and the network provider admits this is one of the side effects.

We are trying to get into the system from another firewall+VPN or SSH, but it's not an easy task.

Regards

Diego KESSELMAN

El 02/06/20 a las 9:11, Steve Pavlichek escribió:

Update. IBM is not sure of the root cause and they say other customers are having similar problems. They recommend that we downgrade the VIOS to a “stable” version earlier than v3.1.1.21 or continue to use the temporary fix of turning LSO off on the IBM I LPARs.

This is a new install on POWER9, VIOS v3.1.1.21 and IBM I v7.4 with latest PTFs

From: Steve Pavlichek<mailto:spavlichek@xxxxxxxxxxx>
Sent: Friday, May 29, 2020 2:23 PM
To: Midrange Systems Technical Discussion<mailto:midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: RE: ACS 5250 VPN Issues

I’ve traced the problem down to the Large_Send Offload. This parameter must match in the switch, VIOS and OS. It is ON by default in IBM I and can not be permanently turned off. You can turn it off for testing (which I did to confirm this is the problem) but the change is only affective until the next IPL.

Customer is trying to find how to change this on their Cisco switch now.

From: DrFranken<mailto:midrange@xxxxxxxxxxxx>
Sent: Friday, May 29, 2020 2:06 PM
To: Midrange Systems Technical Discussion<mailto:midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: Re: ACS 5250 VPN Issues

It was kinda smelling like one of those deep packet inspection thing in
the firewall. Looking at commands and passing ones it knows and blocking
others. However since you gained access to a second machine and they
work there you are likely correct that it's not the firewall.

I have a hard time thinking it's network either because any of the
commands could result in more data than a single packet.

From the way you state it the commands either work or don't work and
are repeatable and consistent?

That really makes me think exit points.

Gotta say this is a weird one!

- Larry "DrFranken" Bolhuis