Client Access Telnet vs. Powerterm

[s***@hotmail.com]

Hi there,
I am totally stumped and not sure what to do about this.
My problem is that I'm trying to work from home (Windows XP Pro- SP1).
Telnetting into our AS400 (V5R3) is easy as I've used Powerterm for
years.

My problem is that I want to do more functions from home such as file
transfers into Excel.

Before I moved to XP Pro and before we migrated from our old 270 (V5R3)
I could do a simple iSeries Access Data Transfer from the Excel
add-ins.

Now I can't. I don't know if the problem is my home PC or something
different with the AS400 and Client Access.

When I try to connect via Client Access from home. (SSL is not enabled
yet), I get these messages in the history trace log:

12/28/2004 6:01:19.18 PM 32-bit Security Type=E CWBSY1003
Server name is invalid -
12/28/2004 6:01:47.57 PM 32-bit Comm-Base Type=E CWBCO1003
Sockets error, function connect() returned 10060
12/28/2004 6:01:47.57 PM 32-bit Comm-Base Type=E CWBCO1048
A time-out occurred trying to connect to the iSeries
12/28/2004 6:01:47.57 PM 32-bit Comm-Base Type=E CWBCO1006
Unable to connect to server mapper
12/28/2004 6:01:47.57 PM 32-bit Comm-Base Type=E CWBCO1011
Remote port could not be resolved
12/28/2004 6:01:47.96 PM 32-bit Security Type=E CWBCO1048
A time-out occurred trying to connect to the iSeries

Why does Powerterm connect so easily and Client Access won't?

Are there additional ports that client access needs that Powerterm
doesn't?

Along those lines, what is the best method to secure the AS400 from
outside our network. We have an public IP address that is mapped to a
private address within our network. But obviously the telnet port is
open. My initial goal was to get telnet SSL running, but the more I
read (redbooks, IBM site) I start to get a little overwhelmed.

I hope someone can help or point me in the right direction on this.
Thanks so much.

...barb

[a***@bigfoot.com]

Client Access requires some other ports besides telnet be open. I
don't recall which ones exactly - 8476 I think is one of them.

The best solutions I have come up with both require a VPN connection.

1. Setup your PC at work with Remote Desktop. Then after VPN connected,
you can "take over" the PC at work, and do anything you normally could.

2. After getting VPN connected, you should be able to access the system
via Client Access, providing the VPN leaves the ports open (most
usually do).

If you don'h have (or don't want) the VPN route, you need to lookup
which ports are needed by Client Access and open them thru the
firewall.

[René H. Hartman]

Post by s***@hotmail.com
(cut)
When I try to connect via Client Access from home. (SSL is not enabled
12/28/2004 6:01:19.18 PM 32-bit Security Type=E CWBSY1003
Server name is invalid -

<cut>

Seems like a name resolution issue. This meand that your CA
configuration is different from your PowerTerm setup.
Using an IP address for PowerTerm? Typo in CA host name?

This is something on TCP/IP level, nothing to do with PowerTerm or CA.
If you cannot resolve the host TCP/IP address, you cannot connect to it.
It's a bit like trying to call someone while you know the name, but
don't have a phone number...

HTH

Regards,
René

[Abbey McA]

Has any of your firewall connections changed? I am using client
access/windows XP1&2 from home, using VPN to connect thru the firewall with
PPTP port so I dont have to keep the TELNET port open. Once a successful VPN
connection is made, then start client access. Or try configuring a new
client access session in case settings have changed? Can you get in using
Telnet?

Post by s***@hotmail.com

Post by s***@hotmail.com
(cut)
When I try to connect via Client Access from home. (SSL is not

enabled

Post by s***@hotmail.com
12/28/2004 6:01:19.18 PM 32-bit Security Type=E CWBSY1003
Server name is invalid -

<cut>
Seems like a name resolution issue. This meand that your CA
configuration is different from your PowerTerm setup.
Using an IP address for PowerTerm? Typo in CA host name?
This is something on TCP/IP level, nothing to do with PowerTerm or CA.
If you cannot resolve the host TCP/IP address, you cannot connect to it.
It's a bit like trying to call someone while you know the name, but
don't have a phone number...
HTH
Regards,
René

[Chris M. Roberts]

Hi Barb,

Regarding your security issue. My organization has two as/400's, only
one has a port to the outside work for user connections. We left port
992 open at the firewall, and I use mocha 5250 to connect via SSL from
home over my regular broadband connection.

There is an option on the telnet servers to make them "SSL" only, From
the main as/400 menu, issue a "Go tcpadm", select 2 for "Configure
TCP/IP Applications", then 11 for "Configure Telnet", then 1 for
"Change telnet attributes". Paramater AWLSSL is what you want, if you
set it to "*ONLY" then port 23 will be closed. Or you can do the same
thing at your firewall, leave telnet alone and just set up the SSL and
leave 992 open. Once I get in to the first box via port 992 I can do a
regular telnet over to the other box.

As for your other issues, the error about "Server Name is invalid - "
leads me to think that you have a configuration problem within client
access. I would launch iSeries navigator and do a right-click on the
server name you are trying to get at and make sure the connection
properties(host name, IP look up, etc) are all set correctly. If SSL
has been configured this is an ideal time to go ahead and try it if you
have the SSL option installed for client access. If you have it, you'll
see it on the properties screen as a "Secure Sockets" tab. You can
download the keyfile from here(the default password for the local
keyfile is CA400, just an FYI..) and then hit verify connection to see
if your name resolution and SSL configuration is working.

Chris

[s***@hotmail.com]

Thanks for the replies. I am going to work with our network admin to
make sure that we get a secure connection configured.

We currently have 23 and 992 open. I attempted to configure an SSL
connection from within our network but apparently didn't set up the CA
or user certificate correctly. I received several errors.
I think I'll be spending some more time reading. :)
Thanks again.
...barb