Workstation Clients through a Firewall

Does anyone out there know if there are any issues with workstation clients going
through a firewall?
Thanks!
mervin

We have done it successfully from NT to a Unix server over afirewall. Its a case
of getting the WSNADDR set up correctly.
use the -H option in the WSL entry in ubb config shows to set it up.
eg
CLOPT="-A -- -d /dev/tcp -n 0x0002nnnnxxxxxxxx -H 0x0002MMMMyyyyyyyy"
Where nnnn is a port number
xxxxxxxx is the true hex IP address of the server
yyyyyyyy is the firewall hex address of the server
MMMM is fixed.
WSNADDR on the PC is set to port number and firewall address.
I know the hex notation is a bit out of date these date but it works fine for
us.
Hope it helps
Sue
"Mervin Calverley" <[email protected]> wrote:
>
Does anyone out there know if there are any issues with workstation clients
going
through a firewall?
Thanks!
mervin

Similar Messages

Sunray soft client through firewall

I searched the wiki but couldn't find any information as to which ports need to be opened up to allow the soft client to work through a firewall. Is there a document somewhere with this information?
We're connecting via SSLVPN. Are there any known issues with the soft client over this type of connection?

Hey Craig,
Thanks for responding.
Yeah, we tried it and it's a no go. It looks a little weird to me in that, in the status box where the client is trying to connect, it never pops up the local IP address of the client like it does here locally when it's connecting to the server. I hope I'm describing that in a sensible way. So here locally, we launch the client, the status box comes up and after a second or so under the client icon you see your IP address and then it tries connecting to the server after which the servers IP shows up and the communications occur to set up the connection. Over the VPN, you never see the local ip. You see the moving arrow between the client icon and the server icon showing that it's trying to connect but no information ever shows up underneath either icon. I believe 22 is highest the status code ever gets during the connection attempt before it starts over. The fact that it doesn't seem to find it's own IP makes me curious as to whether the SSLVPN itself might be causing an issue when it coops the ip stack from the local host. Maybe that's barking up the wrong tree though.
I'm not sure if any of that is helpful at all but that's the behavior we're seeing. We don't control the SSLVPN box nor the Firewalls so we need specific ports to request to have opened by the remote access team. Are they the same as what a regular DTU would need?
This is a holy grail type app for us if we can get it to work within the constraints of our existing VPN.
Thanks again,
Elliott

Re: Runing Forte Runtime Clients using a Firewall

Kamran,
There is an environment variable, FORTE_LOCATIONS, that controls which
port a partition connects over.
David
----Original Message Follows----
Has anybody had to deal with have Forte runtime clients use a firewall?
Who
did you configure the firewall to allow Forte runtime clients to talk to
the
deployed application on the other side of the firewall? Is there any
way to
configure your deployed application to use certain sockets so that you
can
configure the firewall to let client's ip traffic go through using those
sockets? We are using 95 clients and a IBM application server for our
central environment. The firewall will be in the middle monitoring the
traffic. Any suggestion or help would great be appreciated. Thanks in
advance.
ka
Kamran Amin
Forte Technical Leader, Core Systems
(203)-459-7362 or 8-204-7362 - Trumbull
[email protected]
To unsubscribe, email '[email protected]' with
'unsubscribe forte-users' as the body of the message.
Searchable thread archive <URL:http://pinehurst.sageit.com/listarchive/>
Get Your Private, Free Email at http://www.hotmail.com
To unsubscribe, email '[email protected]' with
'unsubscribe forte-users' as the body of the message.
Searchable thread archive <URL:http://pinehurst.sageit.com/listarchive/>

Kamran,
There is an environment variable, FORTE_LOCATIONS, that controls which
port a partition connects over.
David
----Original Message Follows----
Has anybody had to deal with have Forte runtime clients use a firewall?
Who
did you configure the firewall to allow Forte runtime clients to talk to
the
deployed application on the other side of the firewall? Is there any
way to
configure your deployed application to use certain sockets so that you
can
configure the firewall to let client's ip traffic go through using those
sockets? We are using 95 clients and a IBM application server for our
central environment. The firewall will be in the middle monitoring the
traffic. Any suggestion or help would great be appreciated. Thanks in
advance.
ka
Kamran Amin
Forte Technical Leader, Core Systems
(203)-459-7362 or 8-204-7362 - Trumbull
[email protected]
To unsubscribe, email '[email protected]' with
'unsubscribe forte-users' as the body of the message.
Searchable thread archive <URL:http://pinehurst.sageit.com/listarchive/>
Get Your Private, Free Email at http://www.hotmail.com
To unsubscribe, email '[email protected]' with
'unsubscribe forte-users' as the body of the message.
Searchable thread archive <URL:http://pinehurst.sageit.com/listarchive/>

Runing Forte Runtime Clients using a Firewall

Has anybody had to deal with have Forte runtime clients use a firewall? Who
did you configure the firewall to allow Forte runtime clients to talk to the
deployed application on the other side of the firewall? Is there any way to
configure your deployed application to use certain sockets so that you can
configure the firewall to let client's ip traffic go through using those
sockets? We are using 95 clients and a IBM application server for our
central environment. The firewall will be in the middle monitoring the
traffic. Any suggestion or help would great be appreciated. Thanks in
advance.
ka
Kamran Amin
Forte Technical Leader, Core Systems
(203)-459-7362 or 8-204-7362 - Trumbull
[email protected]
To unsubscribe, email '[email protected]' with
'unsubscribe forte-users' as the body of the message.
Searchable thread archive <URL:http://pinehurst.sageit.com/listarchive/>

Yes, please. Actually I'm aware of all you've said. What I'm trying to apply is not a custom build step but a custom tool. (You select the specific file and in properties you're able to set a Custom Tool and Custom Tool Namespace to it)
In my platform specific projects custom tool works fine but in shared project doesn't. Does custom tools work using a custom build step in code behind so that's why I can't apply them to my Shared Project?
Regards

Portal access through a firewall

Hi there!
Having the default installtion of R2 on a single W2K box, what's the minimal procedure to make this configuration available through a firewall?
I've opened ports 7777-7778 but fail when trying to logon via SSO (host.domain.com:7777/pls/orasso)
Have I missed out to open another port or am I forced to follow the steps of setting up a reversing proxy to have portal-access outside the firewall?
Cheers
/Staffan

If they are on different servers, then both are listening on the 7777 port, and you will have to change one of them to use another port (assuming your firewall can only port forward a port to only one host).
If you are running both instances on the same server, then your SSO is accessible via 7777 and your midtier would be on 7778, so your setup as described should be enough (I do the same thing).
If they are running on the one machine, can you access the SSO/INF server directly? http://inf.domain.com:7777 and then http://inf.domain.com:7777/pls/orasso ?

Solaris 10 ssh through a firewall

I have Solaris 10 up and running on an HP Vectra. Everything is fine until I attempt to ssh through my firewall from the outside world.
I can ssh from my linux systems on the lan. But when I attempt to ssh from outside using either putty or ssh on another solaris 10 system the connection times out.
Anyone else experience a similar problem? Many thanks in advance.
John Wright
Asst Professor
CIT
Bellevue University

It's hard to tell what's going on without some more information. Here're a few things you can try:
Run "ssh localhost" from the Solaris box and make sure that works.
ssh to the Solaris box from another box on the same network segment.
From the site that doesn't work, do "ssh -v solaris_box" and see if that gives you any clues.
After trying to ssh from outside, do a "netstat -an |grep -i '*.22' and see the state of the TCP connection
(or if the first packet never even makes it).
Run sshd on the Solaris box with with the "-d" debug option.

A noob asks: Configuring Simpapp to handle workstation clients.

Dear accomplished Tuxedians,
I'm trying to educate myself on Tuxedo 8.1 on Windows XP SP2, and so far
so good. However, I've struck a question that the docs cannot answer.
I've been able to run the simpapp application, and wondered how I could
setup the example to run with a workstation client instead of a native one.
So far I have built the workstation client with "buildclient -w", and
understand that I need to set the WSNADDR environment variable ... and
around here I run out of understanding.
My humble questions to you all are ...
1) What changes need I make to my 'server side' UBBSIMPLE configuration?
2) After changes are made, and I 'tmboot -y' again will that start the
WSL and WSHs that I need?
3) ... or do I need to run 'tlisten' seperately, and if so is tlisten
the WSH or WSL?
4) When establishing the workstation side, what should the TUXCONFIG
look like there?
All clues welcomed,
M.

Thanks for replying Roopesh, predictably I have some further questioning
for you ...
roopesh dubey wrote:
1) What changes need I make to my 'server side' UBBSIMPLE configuration?
--include WSL in ubbsimple .I took a good stab at this, and it's not worked for me, as my
simpapp.exe won't tmboot any more...
Booting admin processes ...
exec DBBL -A :
on simple -> process id=2636 ... Started.
exec BBL -A :
on simple -> process id=3644 ... Started.
Booting server processes ...
exec simpserv -A :
on simple -> Failed.
exec WSL -A //ludwig:45000 -M 5 -x 10 :
on simple -> Failed.
2 processes started.My ubbsimple is attached.
2) After changes are made, and I 'tmboot -y' again will that start the WSL and WSHs that I need?
--yes
3) ... or do I need to run 'tlisten' seperately, and if so is tlisten the WSH or WSL?
--you dont need tlisten .Splendid. Is that because of the existing tlisten/slisten, listening on
port 3050 that gets setup at install-time?
4) When establishing the workstation side, what should the TUXCONFIG look like there?
--tuxconfig not needed at workstation side.Many thanks,
M.
#     (c) 2003 BEA Systems, Inc. All Rights Reserved.
#ident     "@(#) samples/atmi/simpapp/ubbsimple     $Revision: 1.5 $"
#Skeleton UBBCONFIG file for the TUXEDO Simple Application.
#Replace the <bracketed> items with the appropriate values.
*RESOURCES
IPCKEY          123456
#Example:
#IPCKEY          123456
DOMAINID     simpapp
MASTER          simple
MAXACCESSERS     11
MAXSERVERS     5
MAXSERVICES     10
MODEL          MP
LDBAL          N
*MACHINES
DEFAULT:
          APPDIR="C:\bea\tuxedo8.1\samples\atmi\simpapp"
          TUXCONFIG="C:\bea\tuxedo8.1\samples\atmi\simpapp\tuxconfig"
          TUXDIR="C:\bea\tuxedo8.1"
          MAXWSCLIENTS=10
LUDWIG     LMID=simple
#Example:
#beatux          LMID=simple
*GROUPS
GROUP1
     LMID=simple     GRPNO=1     OPENINFO=NONE
WSGROUP
GRPNO=2 LMID=simple
*SERVERS
DEFAULT:
          CLOPT="-A"
simpserv     SRVGRP=GROUP1 SRVID=1
WSL                    SRVGRP=WSGROUP SRVID=1 CLOPT="-A - -n //ludwig:45000 -m 1 -M 5 -x 10"
*SERVICES
TOUPPER

Whenever I try to open up Firefox, it says that it's unable to connect, however, my internet connection is fine and I can still open up Internet Explorer. I already allowed Firefox through my firewall.

My internet connection is fine, I already allowed Firefox through my firewall. This is the first time it had ever happened and it happened suddenly, out of nowhere.

Try "Firefox connection settings" in [[Server not found]]
You can find the connection settings in Tools > Options > Advanced : Network : Connection<br />
If you do not need to use a proxy to connect to internet then select No Proxy
You can also try to remove all rules for Firefox from the permissions list in the firewall and let your firewall ask again for permission to get full unrestricted access to internet for Firefox and the plugin-container process.
See:
* [[Server not found]]
* [[Firewalls]]

Tuxedo 8.1 single context multithreaded workstation client

We just moved to Tuxedo 8.1 from Tuxedo 7.1. One of our appications has started to fail. This particular application is a single context multithreaded workstation client. All Tuxedo operations are performed from the same child thread. The BEA documentation is a little confusing on this topic. Are we required to use the multi context flag?

It should not be necessary to use the TPMULTICONTEXTS flag for a
single-context client, even if it is multithreaded. What is the nature of
the failure that you are seeing?
<Jacque Cole> wrote in message news:[email protected]..
We just moved to Tuxedo 8.1 from Tuxedo 7.1. One of our appications has
started to fail. This particular application is a single context
multithreaded workstation client. All Tuxedo operations are performed
from the same child thread. The BEA documentation is a little confusing
on this topic. Are we required to use the multi context flag?

H can we send script form to client through mail.

h can we send script form to client through mail.

<<removed by moderator>>
Search SDN for more details on these...
Thanks,
Anmol.
Edited by: kishan P on Apr 6, 2011 11:49 AM

Error installing MBAM client through SCCM task sequence error code 80070005

Hi
I'm getting a weird error when trying to deploy the MBAM 2.0 client through a task sequence, it was working but now keep seeing the below two errors in the AppEnforce log, after it has returned the 3010 soft reboot code.
CoCreateInstance failed on CLSID_ProductSrcUpdateMgr, error 80070005
Failed to update msi source list, error 0x80070005
does anyone have any idea what these mean?
thanks
Mark

What is the silent installation command line for MBAM client you are using. I would suggest to first test the silent installation manually and test whether it is working successfully or not.
Are you using the msi installer or the setup.exe
Command Line for Deploying the MBAM 2.0 Client
MBAMClientSetup.exe /q
Gaurav Ranjan

Endpoint on DMZ interface (through the firewall)

Hi
I have an ASA which connects to a BT Inifinty router. The address on the outside interface is dynamic. BT provide us with 5 static addresses (No NAT 5) which are routed to the outside interface but are a different subnet.
I would like to terminate the site to site VPN using one of the static IP addresses rather than the outside dynamic address.
Can I NAT the public static address to the DMZ interface (or any interface for that matter) and terminate the VPN on that interface i.e. the firewall is terminated through the firewall?
Thanks
Stuart
Update: A few people have looked but no answer. Is there some detail I need to add?

Matheus.Omega.Mendes wrote:
Well one solution that they found was implements one hollow interface called InterfaceWeb, just to mark the classes that works on web and desktop, although our system isn't perfectly object oriented, this solution was the worst that I ever seen. At least I think this way and I'd like to know if someone agree, disagree or have some explication for this choose.Hard to say without actually seeing it. Probably not a good idea.
Presumably the design was driven by time to market and cost rather than just because the developers didn't want to refactor.
As per the other suggestion, normally besides breaking the layers out you could share common functionality with a layer of its own (or several)

Call of tuxedo workstation client to tuxedo service

In ubb file:
"WSL" SRVGRP="GRP" SRVID=44
CLOPT="-A -- -p 10002 -n //172.17.1.10:10001 -P 10003 -T 180"
My question is:
1. In workstation client, WSNADDR is //172.17.1.10:10001. If I use "172.17.1.10:10001", it prompts "TPESYSTEM - internal system error", while "//172.17.1.10:10001" is right?
2. 10001 is the port of WSL, 10002-10003 is the port of WSH. But in ubb file, I cannot find WSH configuration, is that right?
3. If "telnet 172.17.1.10 10002(/10003)" doesn't work in workstation client, does it impact the call of tuxedo service from this workstation client?
Thanks a lot.

Bill,
1. Tuxedo syntax for specifying TCP/IP addresses requires that the address start with "//", so it is expected behavior for "172.17.1.10:10001" to result in an error and for "//172.17.1.10:10001" to be correctly parsed.
2. You're correct that the UBBCONFIG file does not include entries for WSH processes. WSH processes are started by the WSL as appropriate.
3. The Tuxedo WSH communicates with workstation clients and with the WSL using a proprietary Tuxedo workstation protocol. The WSH does not understand telnet protocol, so any attempt to telnet to the WSH port will not succeed.
Regards,
Ed

How can SAP tRFC server tell client through JCo that function carried out?

SAPs "Transactional RFC Technical Description" document (release 4.0) says in section Transactional RFC on page 6: "Finally, the server tells the client, that the function has been carried out and the client acknowledges this.".
How can the server tell this to the client when the server communicates with the client through JCo (Java Connector)?

System.out.println goes to console, which is not a file... This whole thing is much easier if you use standard logging:
http://help.sap.com/saphelp_nw04/helpdata/en/d2/5c830ca67fd842b2e87b0c341c64cd/frameset.htm

How to allow Flash, Reader, and Shockwave installations through the firewall?

When I allow a single machine to full access through the firewall on port 80, all three products install flawlessly. I am trying to narrow this down and only open the specific IP ranges used by adobe. Does anyone know which ones need to be allowed for this to work? Also, I do know about the standalone files that can be downloaded and then installed to avoid the firewall issue, but I would like to allow all users who bring their own devices to install these products. With the below IP address open through port 80, I am able to install Flash almost every time, but Reader and Shockwave are less reliable. Thank you for any help you can provide.
Bill
23.67.250.122
23.67.250.129
23.67.250.104
23.67.250.147
23.15.7.153
23.15.7.130
23.15.7.160
23.15.7.99
23.15.7.155
23.15.7.113
23.15.8.203
23.57.1.169
23.57.3.235
23.67.250.88
23.57.2.70
8.10.179.247
66.235.147.77
96.17.160.72
96.17.160.18
192.150.16.58
192.150.16.64
193.104.215.66
199.167.187.72

I have a method that works for FLASH player, but am trying to come up with a method for the other 2 myself. To automate flash player, I created a Policy and added the following:
Under Computer Config, Prefrences, Windows Setting, Files I created a new File Item.
I set Action = Replace, Created a Source File named mms.cfg* (more below) and have the destination file as systemroot%\System32\Macromed\Flash\mms.cfg (or %systemroot%\SysWOW64\Macromed\Flash\mms.cfg for x64)
I used notepad to edit the mms.cfg, and used the following in the body:
AutoUpdateDisable=0
SilentAutoUpdateEnable=1
AutoUpdateInterval=0
My non-admin users now update flash in the background silently and automatically.

Workstation Clients through a Firewall

Similar Messages

Maybe you are looking for