Re: Service Agent through NAT firewall -- MIDRANGE-L

Jim Franz schrieb:

I need to make Service Agent work as well as ECS.
On the GO Service menu I run the "17. Verify Service Agent Connection"
and get a Java Exception 255 in job log - no other explanation.
Machine is talking to other servers on local & net, but firewall admin insists
we use Nat translation at the Cisco firewall, so i5 has a private address,
and firewall has the public address. The Info center docs and Knowledge Base
docs all say this is supported if the firewall 'encapsulates the UDP' - and I just
googled that phrase and found a Cisco doc explaining. (Sometimes it takes
writing this out to determine the right words to google...)
The java exception may be a diff problem, but till firewall correct, nothing is
getting though.
Ops Nav is not working to set this new server's Service Agent config.
Management Central is fixated on the old v4r5 server still in production
(on pain of death I cannot mess with) and every time I try to configure
the new server's agent, it wants to log onto the old server (new version
of iSeries Access).
Jim Franz

----- Original Message ----- From: <kirkg@xxxxxxxxxxxxx>
To: "Midrange Systems Technical Discussion" <midrange-l@xxxxxxxxxxxx>
Sent: Monday, February 11, 2008 2:10 PM
Subject: Re: Service Agent through NAT firewall

Actually unless you are using a Proxy then the current ECS stuff should
try and number of protocols starting with a VPN tunnel and ending up using
a HTTP if I remember correctly. I general terms, if the i5 can see the
Internet and resolve IP names to addresses it 'should', work.

Double check you have a proper Default Route (CFGTCP #2) and in CFGTCP #12
you have good addresses for the DNS Servers. There is also a log GO
SERVICE #14 ( I think ) you can review too if you haven't already.

--
Kirk Goins
Systems Engineer, Manage Inc.
IBM Certified in i5 Solution Sales,
i5 Technical Solutions Expert V5R4,
iSeries Multiple Systems Administrator V5R3,
Systems Expert - i5 LPAR Technical Solutions V5R3

Office 503-353-1721 x106 Cell 503-577-9519
Home Office 503-674-2985
kirkg@xxxxxxxxxxxxx www.manageinc.com

Email Response Times:
Same Day Maybe, Next Day Probably

<franz400@xxxxxxxxxxxx>
Sent by: midrange-l-bounces@xxxxxxxxxxxx
02/11/2008 09:12 AM
Please respond to
Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>

To
midrange-l@xxxxxxxxxxxx
cc

Subject
Service Agent through NAT firewall

This is Electronic Svc Agent *Primary & *Direct
i5 does not have a public ip.
Read the docs on IBM site. Firewall admin does not "get" the encapsulation
part.
He has opened the ports & protocols in doc. Still not working.
Does anyone have a sample or something in "Cisco" language to indicate how
this
is configured on firewall. (offline if desired).
Jim Franz

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Hello Jim,

you won't get this to work unless you follow a special "Reset" procedure for
the fragments of the old setup in your config.
Hopefully this will get rid of the java exception as well.
Then and only then you will be able to try with your firewall again, before it is
senseless.
Once I ran into this I had to call IBM support to clean things up, maybe you
can find something by googling around if you're not under maintenance.
Regards from Germany,