Novell Client with NCS cluster behind firewall (IP filter)

I try to connect with Novell Client on Windows to a OES NCS cluster
behind a firewall. Currently open ports are 524/tcp, 524/tcp, and
427/tcp for the Master IP Address and the virtual servers.
This does not work. My first analysis shows that the client tries to
connect to the host running the Master IP Address with it's primary IP.
Is this correct? Is there a way to use the Novell Client without
allowing packets with the destination IP address of the NCS cluster hosts?
Gnther

Massimo Rosen wrote:
> On 29.03.2011 17:22, Gnther Schwarz wrote:
>> I try to connect with Novell Client on Windows to a OES NCS cluster
>> behind a firewall. Currently open ports are 524/tcp, 524/tcp, and
>> 427/tcp for the Master IP Address and the virtual servers.
>> This does not work.
>
> Correct.
>
>> My first analysis shows that the client tries to
>> connect to the host running the Master IP Address with it's primary IP.
>> Is this correct?
>
> Yes, assuming it holds a replica of eDirectory.
>
>> Is there a way to use the Novell Client without
>> allowing packets with the destination IP address of the NCS cluster
>> hosts?
>
> No, because the physical hosts are the ones running and advertising
> eDirectory, and a client needs to login to edirectory too, in addition
> to the actual server holding a resource it needs. In essence, you cannot
> / should not hinder connectivity to any physical server holding
> writeable eDirectory replicas, and you can not do this for any master
> replica. At the very least you'll be causeing massive slowdowns, if
> necessary master replicas can't be reached, it'll be stopped from
> working entirely.
Thank you very much indeed for the thorough answer and explanation. We
adjusted the rules on the router appliance and are able to connect now.
Ports 524 und 427 are exposed for tcp and udp on all physical and
virtual servers including the Master IP Address.
Gnther

Similar Messages

Apex with Database XE behind Firewall?

Hi. I have an Apex application that I would like to put up on the Internet. The associated database must be protected with a firewall between it and the HTTP server. I would like to use the Express Edition (XE) version of the database, at least initially.
Is it possible with XE to have a listener connect through a firewall to an HTTP Server?

Absolutely, wasn't talking about the internet facing firewall in the DMZ but the inner firewall between the OHS/Apex Listener server and Database. Obviously the best solution is to have a reverse proxy server in the DMZ (i.e. between inner and outer firewalls) and the OHS and database on the internal side of the DMZ.
First case Standard HTTP or HTTPS port open on the outer DMZ firewall to OHS/Apex Listener Server obviously better to be HTTPS, SQLNET listener port to access Database on the inner firewall better if it's a not the standard 1521
Second Case Standard HTTP or HTTPS port open on the outer DMZ firewall to reverse proxy server, non-standard HTTP(s) e.g. 7777 to OHS server on the inner firewall there would be no firewall between OHS and Database in this case.

Novell Client OpenSuse 10.3

I am trying to use the Novell Client with Opensuse 10.3.
I followed the coolsolutions "patch" and everything loads as it should. I
get the novell client login box but when I try to login it gives a
security error message:
"Novell Security Message
Cannot access tree " <<displays our tree>>".
I can browse the trees from Advanced but when I try to browse contexts it
displays the same error message.
I have tried to have a look through this area but can not find a suitable
solution. I have disabled the firewall (temporarily - while trying this).
I have CASA enabled, I have OpenSLP setup and running.
Am I missing something obvious?

Oh yes... I'm having the same problem. I BELIEVE if you use Konqueror it works. I haven't tried recently but last time I tried it worked fine in Konqueror.
My larger issue is when I shut down, it hangs at the point of trying to unmount all the mounts. I only get the hang when the novfs module unloads without error (which is rare).
There is something on bugzilla about this but I haven't seen any updates on when it will be fixed.
Originally Posted by Joshua Bergland
On Wed, 16 Jan 2008 18:11:24 +0000, Andy wrote:
> I am trying to use the Novell Client with Opensuse 10.3.
>
> I followed the coolsolutions "patch" and everything loads as it should.
> I get the novell client login box but when I try to login it gives a
> security error message:
>
> "Novell Security Message
>
> Cannot access tree " <<displays our tree>>".
>
> I can browse the trees from Advanced but when I try to browse contexts
> it displays the same error message.
>
> I have tried to have a look through this area but can not find a
> suitable solution. I have disabled the firewall (temporarily - while
> trying this). I have CASA enabled, I have OpenSLP setup and running.
>
> Am I missing something obvious?
I got around this by putting my full context in the user field.
The real problem I am having with the client on 10.3 is that it tells me
my mapped drives have no free space when I try to write to them. Anyone
else having this issue?
Josh

Client issues from behind firewall (login delays)

I have a Novell 6.0 server outside the firewall and am beginning to set
up clients on the inside of the firewall. There appears to be no
issues with the outside clients connecting to the outside server.
However I am having strange issues with the inside clients
authenticating to the outside server. (all clients are WinXP)
If I do not sit for at least 10 seconds at the novell login screen on
the client at first boot-up before attempting to login, the client will
fail. If I try again after that, it goes right in. If I do wait for
the 10 seconds, the client authenticates the first time.
If I put an IP address in the server name field of the login dialog
box (instead of the servers FQDN) the client authenticates the first
time.
Has anyone seen this before or know where to begin looking? There does
not appear to be a delay issue with the DNS server, as once the desktop
is up all web browsing and pings respond quickly.
Thank you for any help you can provide.

Thanmad,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Do a search of our knowledgebase at http://support.novell.com/search/kb_index.jsp
- Check all of the other support tools and options available at
http://support.novell.com.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://support.novell.com/forums)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://support.novell.com/forums/faq_general.html
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://support.novell.com/forums/

Problem connectiong to V3K cluster behind a firewall

Hi
Cannot establish VPN tunnels to a VPN cluster behind a Stongate-1000 firewall, however connection to any of the VPN concentrator devices works fine. What could be the cause of this problem?
Thanks in advance

Hi
I am using th IP address to connect.
If I try the real IP address of one of the concentrators, the vpn tunnel can be established, but if I connect through IP address of the VPN cluster the vpn fails to establish. Althgough when I remove the Stongate firewall between the client and the cluster, everything works fine.

What are prerequisite for Design Studio Client tool behind firewall?

Hi Experts,
Can you tell me what are prerequisites for Design Studio Client tool behind firewall?
Best Regards,
Pushkar

Hi Pushkar,
In which 'mode' would you like to use the Design Studio Client application. Connected to the BI platform, SAP HANA, etc?
With kind regards,
Martijn

PAT with a single public IP and several servers behind firewall

Hi,
New to the ASA 5505 8.4 software version, but here is what I'm trying to do:
Single static public IP: 16.2.3.4
Need to PAT several ports to three separate servers behind firewall
One server houses email, pptp server, ftp server and web services: 10.1.20.91
One server houses drac management (port 445): 10.1.20.92
One server is the IP phone server using a range of ports: 10.1.20.156
Basically, need to PAT the ports associated with each server to the respective servers behind the ASA 5505.
Here is what I have. Is anything missing from this config? Do I need to include a global policy for PPTP and SMTP?
ASA Version 8.4(4)1
hostname kaa-pix
names
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
interface Vlan1
nameif inside
security-level 100
ip address 10.1.20.1 255.255.255.0
interface Vlan2
nameif outside
security-level 0
ip address 16.2.3.4 255.255.255.0
ftp mode passive
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network server_smtp
host 10.1.20.91
object service Port_25
service tcp source eq smtp
object service Port_3389
service tcp source eq 3389
object service Port_1723
service tcp source eq pptp
object service Port_21
service tcp source eq ftp
object service Port_443
service tcp source eq https
object service Port_444
service tcp source eq 444
object network drac
host 10.1.20.92
object service Port_445
service tcp source eq 445
access-list acl-out extended permit icmp any any echo-reply
access-list acl-out extended permit icmp any any
access-list acl-out extended permit tcp any interface outside eq pptp
access-list acl-out extended permit tcp any object server_smtp eq smtp
access-list acl-out extended permit tcp any object server_smtp eq pptp
access-list acl-out extended permit tcp any object server_smtp eq 3389
access-list acl-out extended permit tcp any object server_smtp eq ftp
access-list acl-out extended permit tcp any object server_smtp eq https
access-list acl-out extended permit tcp any object server_smtp eq 444
access-list acl-out extended permit tcp any object drac eq 445
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat (inside,outside) source static server_smtp interface service Port_25 Port_25
nat (inside,outside) source static server_smtp interface service Port_3389 Port_
3389
nat (inside,outside) source static server_smtp interface service Port_1723 Port_
1723
nat (inside,outside) source static server_smtp interface service Port_21 Port_21
nat (inside,outside) source static server_smtp interface service Port_443 Port_4
43
nat (inside,outside) source static server_smtp interface service Port_444 Port_4
44
nat (inside,outside) source static drac interface service Port_445 Port_445
object network obj_any
nat (inside,outside) dynamic interface
route outside 0.0.0.0 0.0.0.0 16.2.3.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
telnet timeout 5
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
prompt hostname context
no call-home reporting anonymous

Thanks Lcambron...I got PPTP to work. Everything else works fine. I can access email, access my web server, FTP server, and PPTP server. However, from the above configuration, I cannot access my DRAC over the internet..The DRAC runs on a different internal server, and over port 445. So I have th following lines:
object network drac
host 10.1.20.92
object service Port_445
service tcp source eq 445
access-list acl-out extended permit tcp any object drac eq 445
nat (inside,outside) source static drac interface service Port_445 Port_445
Am I missing something here? Internally, i can telnet to port 445 on 10.1.20.92, so I know it is listening. However, externally, i cannot telnet to my external ip address of the ASA through port 445.
Thanks

I have installed the agent 10 or 15 times and one installation hasfailed, no error appeared during the installation but I am havinginconsistent issues with my ethernet card not working here and there. Werebooted and can log into Novell client but th

I have installed the agent 10 or 15 times and one installation has failed, no error appeared during the installation but I am having inconsistent issues with my ethernet card not working here and there. We rebooted and can log into Novell client but the login prompt did not appear for ESM client or the icon was not in the systray. Everything seems to work, besides at times (a couple times today) it terminates his ethernet card/connection. I would re-image his computer but he has several applications and it would take several hours, so I am hoping someone has an idea to fix this issue. So I was trying to figure out why he did not get the prompt to login and why it's not in the systray and it appears to not have completed the install? I checked the add/remove programs, its not listed within their, I also checked the registry and found nothing for endpoint within their, but the files are within c:\program files\novell\zenworks endpoint security.
I have also tried uninstalling it but that fails due to it "not being installed", and it will not reinstall over itself either.
I did notice that stuninstdrv.exe is running in task manager. Any help would be great...
Windows xp sp3
ESM 3.5.154
Thanks,
Andy

If you are searching the registry, check for the "Senforce" string. It should be at HKLM\Software\Senforce
Try running the install program for the ZSC with the following command line:
setup.exe /V"STUNINSTALL=1"
If you've specified an uninstall password, try this one instead:
setup.exe /V"STUNINSTALL=1 STUIP=password"" (please note the double quote at the end)
Let me know if that helped you.
Daniel
>>>
From: Andy_DeWees<[email protected] du>
To:novell.support.zenworks.endpoint-security-management
Date: 2/5/2009 12:52 PM
Subject: I have installed the agent 10 or 15 times and one installation hasfailed, no error appeared during the installation but I am havinginconsistent issues with my ethernet card not working here and there. Werebooted and can log into Novell client but the login prompt did not appearfor ESM client or the icon was not in the systray. Everything seems towork, besides at times (a couple times today) it terminates his ethernetcard/connection. I would re-image his computer but he has severalapplications and
I have installed the agent 10 or 15 times and one installation has failed, no error appeared during the installation but I am having inconsistent issues with my ethernet card not working here and there. We rebooted and can log into Novell client but the login prompt did not appear for ESM client or the icon was not in the systray. Everything seems to work, besides at times (a couple times today) it terminates his ethernet card/connection. I would re-image his computer but he has several applications and it would take several hours, so I am hoping someone has an idea to fix this issue. So I was trying to figure out why he did not get the prompt to login and why it's not in the systray and it appears to not have completed the install? I checked the add/remove programs, its not listed within their, I also checked the registry and found nothing for endpoint within their, but the files are within c:\program files\novell\zenworks endpoint security.
I have also tried uninstalling it but that fails due to it "not being installed", and it will not reinstall over itself either.
I did notice that stuninstdrv.exe is running in task manager. Any help would be great...
Windows xp sp3
ESM 3.5.154
Thanks,
Andy

Issue with Adobe flex data.xml file not reachable from bsp behind firewall

Hi Gurus,
I have a problem with the <mx:HTTPService> tag the following is the actual tag,
<mx:HTTPService
id="Srv"
url="data.xml"
useProxy="false"
method="POST" result="resultHandler(event)"/>
When accessed locally I can see the data in the flex as the data.xml can be reached. when the same is accessed from internet behind firewall, the url is entirely different and the .swf file in the BSP page cannot access the data.xml. I cannot give the absolute url in the tag as the BSP page application is accessed differently in different servers. any help on this would be greatly appreciated
Thanks
Akbar

Sorry somehow I missed this question, an even easier way to do this is to allow your Flash movie to "script" ( this is the default behavior for a Flex application ) and then call some javascript to obtain exactly what the page URL is and then go from there to get your data:
import flash.external.ExternalInterface;
import mx.utils.URLUtil;
var
if(ExternalInterface.available){
pageURL = ExternalInterface.call("window.location.href.toString");
// Do whatever you need with the URL here.
var serverName:String = URLUtil.getServerNameWithPort(pageURL);
-d

Login intermittently slow with ZCM agent AND Novell client

We continue to struggle with intermittently slow logins in our environment. In testing, we noticed that logins are very fast (10-20 seconds) when only the Novell Client is installed, and very fast (~10 seconds) when only the ZCM agent is installed. However, when they are both installed, logins slow down, sometimes to 1.5 minutes or longer.
We have checked DNS and rDNS, and they are both configured properly. SLP is working properly as demonstrated by the fast logins when only the client is installed. We use LDAP for user lookup, and it also works very fast to resolve user names (~ 1 second).
We are using ZCM 10.3.1, and the client is fully patched as well (both Novell Client 2 and 4.91)
Are there any specific settings (for the ZCM agent or the client itself) that might address this issue?

My apologies, I told you to remove the wrong thing.
I should have said NMAS instead of CASA.
I am just so used to saying CASA when talking about ZCM.
In regards to NMAS, you could simply rename "NWSSO.DLL" as a test.
If NMAS is installed which is tested by the existence of this DLL, then
a certain NMAS call is always made, which in some cases can take a long
time.
On 11/9/2010 12:06 PM, dshofkom33 wrote:
>
> craig_wilson;2042688 Wrote:
>> Try removing CASA from the device and see if that makes a difference.
>> A TID will be out on the issue soon.
>>
>> On 10/5/2010 4:36 PM, kjhurni wrote:
>>>
>>> Hmm, I will have to try that. I've only observed that with ZCM
>>> installed (with Novell Client 4.91 SP5 on XP) that the login time
>> goes
>>> from about 12-15 seconds to about 50-70 seconds.
>>>
>>> But I've not tried "just" the ZCM agent.
>>>
>>>
>>
>>
>> --
>> Craig Wilson - MCNE, MCSE, CCNA
>> Novell Knowledge Partner
>>
>> Novell does not officially monitor these forums.
>>
>> Suggestions/Opinions/Statements made by me are solely my own.
>> These thoughts may not be shared by either Novell or any rational
>> human.
>
> I removed CASA and now I cannot sign into ZCM. I get the "unable to
> login to network because the login credentials are incorrect" Windows
> Security Message. Any ideas?
>
>
Craig Wilson - MCNE, MCSE, CCNA
Novell Knowledge Partner
Novell does not officially monitor these forums.
Suggestions/Opinions/Statements made by me are solely my own.
These thoughts may not be shared by either Novell or any rational human.

How much info about the cache-cluster does the client have and What would you recommend about putting the cluster behind virtual ip

Hi,
I will appreciate if someone can point me to some documentation as to how app-fabric client library accesses the app-fabric cluster.
What I have found so far is that the list of hosts provided in the client configuration are used as an entry point into the Cache-Cluster. By connecting to one of hosts, the client will download information about all the hosts constituting the cluster.
Since a named cache is distributed across the entire cluster, and the data can be stored on any node. How does the client decide which node it should connect to, to get the data from. Does the client have enough information to know which host has the data
or the client will connect to one of the nodes, if the node has data, it will serve it otherwise redirect the client to the node that has the data.
I also would like to know what do you say about the idea that we would like to put our cache-cluster behind a virtual ip, so that if needed, we can take down nodes or add more nodes. In fact the virtual ip will that of a load balancer, but we don't plan to
use it for load balancing purposes but the idea is that the client will have the virtual ip address and we can repoint this IP address, if we need to take out a node for maintenance reason.

I'm not sure about the reason for putting the cache servers in a VIP, but one of the reasons why the cache servers should be made known to the servers is because of auto load balancing and throughput
Imagine i have 10 cache servers running on 1G ethernet links, theoretically i have 10G usable bandwidth and the clients will be able to manage and load balance if any of the cache server fails or have performance issues
Now if all these were parked behind a VIP
1. The LB now does the load balancing, which may not be optimal
2. The LB may not have 10G upstream and 10G downstream, even if it has, this is quite a waste of resource\

Firewall rule for Novell Client

My company recently purchased McAfee Desktop Firewall and I'm trying to
configure the rules prior to deployment but I'm having trouble getting
the Novell Client to cooperate. I've tried having the firewall "learn"
the client, addresses, ports, protocols, etc. but have had no luck.
My company is running a mix of Win2k/XP computers as well as Win95/98
computers so any assistance in creating a firewall rule to allow the
clients to log in is greatly apprecaited.
Thanks!
Ash

Excellent, thanks!!
> For NetWare connectivity over IP, you need ports TCP,UDP 524 and 427
> which are NCP over IP and SLP.
>
>
> --
> Edison Ortiz
> Novell Product Support Forum SysOp
> (No Email Support, Thanks !)

Roaming profiles did not work with Novell client

I've Problems with roaming profiles.
It is perhaps not a Novell problem but anything with windows rights?
We use ZCM11: (Server: SLES11 SP1)
Client new PC with a freshly installed Windows7, all updates.
(Only Turn on file and printer sharing, anything else default, no virusscanner)
The pre-agent has been installed and then the the Novell Client 2SP1 IR7
The PC gets a "Dynamic Local User Policy" with the settings:
- Use the credentials of the user source
- (Manage existing user account - but we have none there)
- Volatile user (with no cache, meaning that the user is immediately deleted ... We have also tested with cache.)
- e-dir user should be only member of Users
The users from edir get a Roaming Profile Policy with:
- Store user profile in user's Home Directory. (which is on the OES/SLES server)
---- results ----
If the user has no centrally stored profile, then he can log on but just once!
(if "Enable Volatile User cache" also several times to the same PC)
If the user already has a stored profile, he can not log on Error: "The Group Policy client service failed the logon Access is denied"
In my view, the following happens. W7 create the user locally and want's put in the settings from a central profile in the local
Profile and can not do that.
Only when no "central profile" is there in the homedir, or if this profile does not contain the file ntuser.dat, the user can log in locally.
However, no files are used from te saved profile, for instance from the saved desktop.
I can not imagine that anyone around the world with ZCM11 on a SLES/OES Server don't use the Novell client and raoming profiles
It must therefore give a simple trick to solve the problem.
But which one? Can some one here help me?

Alix,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Visit http://support.novell.com and search the knowledgebase and/or check all
the other self support options and support programs available.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://forums.novell.com)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://forums.novell.com/faq.php
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://forums.novell.com/

Imgexp.exe proplem with Novell Client 4.91SP5

I have Novell Client 4.91SP5 and the Novell Application Launcher Version 7.0.1.4. I am trying to use imgexp.exe v7.0.1.0 to create zmg files for addons. I can add individual files but I can not add folders. When I drag the folders to imgexp it does nothing. If I click on the folder icon, with the plus next to it, within image explorer and select a folder I get: ZENworks Image Explorer has encountered a problem and needs to close. We are sorry for the inconvenience. When I click on Don't Send, I get: The instruction at "0x73dd1c7" referenced memory at "0x00000004". The memory could not be "read". Click on OK to terminate the program. I have tried running it from the server and the hard drive and have the same problem. Thanks.

I am running Windows XP SP3 with all hotfixes. Drive Y is a network drive. This is a SLES 10SP2, OES2SP1 server. However I also have the same problem with a NW6.5SP8 server. All volumes are NSS. I have installed imgexp on both my hard drive and the server and have the same problem from both locations. I also have the Novell Client patches through May of 2009. I noticed that there are 3 new beta patches for the client after August that I have not installed. Is there a client setting that may affect this?

Callback cannot be done if client behind firewall. But WHY?

I've read a lot of threads regarding callback is not achievable if client is behind firewall. But i couldn't find the DETAILED reason for that. Can anyone explain that?
Thank,
Jax

In order for a server to asynchronously callback a client, it must create an inbound socket connection to the client, to send the message. This is precisely the type of thing a firewall is designed to prevent.
To receive callbacks, the firewall would have to open a specific port for inbound connections to the client, and the server would have to be aware of this port as well.

Novell Client with NCS cluster behind firewall (IP filter)

Similar Messages

Maybe you are looking for