Originally printed in the June/July 1998 issue of MC’s AS/400 Internet Expert newsletter (now AS/400 NetJava Expert), this article provides a tutorial for the installation of IBM’s Firewall for the AS/400 product. Chris Green, AS/400 NetJava Expert’s security expert and co-author of the IBM redbook Protecting Your AS/400 from Harm on the Internet explains the requirements for the AS/400 firewall and then shows you how to install and configure it from the comfort of your favorite Web browser.

You know that if your site has any sort of Internet access at all, you need a firewall. If you don’t have a firewall up at your Internet-enabled site, might I suggest a few other activities you might enjoy: taking pans out of the oven with your bare hands, driving without a seatbelt, or skydiving with no parachute? Like the safety demonstration at the beginning of every airplane ride, this article will give you the information you need to make use of the safety equipment IBM provides. This article will show you how to install the IBM Firewall for AS/400 software and get it up and running. This will provide you with a leaping-off point from which you can configure the various components of the AS/400 firewall: proxy serving, SOCKS serving, packet filtering, the mail gateway, and others.

Prerequisites

First, I’ll outline what you need to have in place before you can install the firewall software. You’ll need a dual-port Integrated PC Server (IPCS), previously known as FSIOP. You can install the firewall software using a single-port IPCS, but from what I can deduce from the AS/400 firewall architecture, there is no functionality that will be of any benefit if you are using only one port.

IBM says the minimum requirement for the IPCS hardware is a 100 MHz Pentium with 64 MB of RAM. I personally think you need at least 128 MB of RAM. You don’t want a firewall bottleneck backing up all of your Internet communications.

Your AS/400 must be running OS/400 V4R1 or higher, which means you’ve got a RISC box. You’ll also need to have the following software components installed: TCP/IP

Connectivity Utilities (5769-TC1), Integration Services for FSIOP (5769-SA2), and Firewall for AS/400 (5769-FW1). Once all of these requirements are fulfilled, you can proceed to the installation of the firewall. You must install the software on the actual IPCS that will be dedicated to the firewall.

Getting the Admin Instance Running

From your favorite Web browser, using pages served by your AS/400, you can perform all the required administration, configuration, and installation tasks. The URL to access your AS/400’s Web administration page is your AS/400’s domain name or TCP/IP address followed by the port number of 2001.

Note that the AS/400 administration server will prompt for a valid user profile and password. Also note that access will be denied if the entered user profile does not have the appropriate authority.

Before you can use your Web browser to install the firewall, you will first need to ensure that the Admin server instance is running on the AS/400. To learn more about what a server instance is, refer to the article entitled “An Introduction to Configuring the V4R1 Web Server” in the February/March 1998 issue of AS/400 Internet Expert. For the purposes of this article, know that an AS/400 can serve multiple HTTP server instances, and each instance can each have completely unique properties and bind to different TCP/IP ports and Internet Protocol (IP) addresses.

The Admin server instance is an IBM-created instance that allows you to configure different aspects of Web serving and TCP/IP applications through a Web browser. When the IBM Firewall for AS/400 software is installed on the AS/400, the Admin instance will be updated to allow you to install the firewall. The Admin instance is directly dependent upon what software is installed on your AS/400. It will not let you configure a software component that is not installed.

To confirm that the Admin server instance is running, issue the WRKACTJOB SBS(QSYSWRK) JOB(ADMIN) command from an AS/400 command line. If no entries appear, you’ll know that the server instance is not running. To start the instance, simply issue the command STRTCPSVR SERVER(*HTTP) HTTPSVR(*ADMIN)and press Enter. After a few moments, the Admin server instance will be started.

Using the Admin Instance

Now that you have the Admin instance running, you can utilize its services. In order to do this, start your Web browser and connect to http://www.youras400.com:2001. (Of course, you’ll have to substitute www.youras400.com with the IP address or fully qualified domain name of your AS/400.) The :2001 is very important, because 2001 is the port that the Admin instance is bound to. Once you enter this URL, you will be prompted for a user ID and password. The user ID should have a minimum user class of *SECADM with *IOSYSCFG special authority. Enter the password and user ID, and click on the OK button.

If the user ID and password pair is allowed, you will be presented with the default Web page for the Admin instance (see Figure 1). If the Firewall for AS/400 licensed program (5769FW1) is installed, you should have a link entitled IBM Firewall for AS/400. Click on this to start the installation process.

What You Need to Know

The table in Figure 2 contains a list of variables and their descriptions. You will need to know what these variables do when you are installing the firewall. When a screen appears asking for a variable, it will tell you what is needed to continue, but it is a good idea to understand the parameters and what they control before you start.

Getting Down to Business

Once you have made sure you have fulfilled all the prerequisites, gotten the Admin instance running, and familiarized yourself with the parameters, you can install and start running the firewall.

Look back at your browser, which should still be pointing to the IBM Firewall for AS/400 link. In the left frame, there will be a link entitled Installation (see Figure 3). Click on this link to continue.

At this point, the right-hand frame will be updated. At the bottom of that frame, you will see a button entitled Next (see Figure 4). Once you have read the text, click on the Next button.

At the risk of being verbose or, dare I say, boring, I will briefly outline the remaining steps. As you will see from the installation, all you have to do is fill in the blanks. You should already have the parameters, so now just match the parameters that you have with the prompts that the AS/400 provides. Those of you familiar with PCs can associate these steps with a software configuration wizard.

Once you have entered the parameters and read the text for the page, click on the Next button to continue.

1. Once you click on the Next button in the first installation screen, you will be given a list of parameters required for the installation. This is similar to the table in Figure
2.

2. Select the IPCS Hardware Resource Name from the list presented.

3. A description of the IPCS that you just selected will appear. If the information is incorrect, then press the Back button and select the correct IPCS Hardware Resource Name. Otherwise, you can continue on to the next step.

4. Enter the Firewall Name.

5. Select the LAN type for port 1; one of the more common types is 10 megabits per second (Mbps) Ethernet.

6. Enter the adapter address for port 1.

7. Enter the IP address for port 1.

8. Enter the subnet mask for port 1.

9. Select the LAN type for port 2.
10. Enter the adapter address for port 2.
11. Enter the IP address for port 2.
12. Enter the subnet mask for port 2.
13. Enter the IP address of the Internet router. A confirmation screen will appear containing all the parameters you have just entered. Confirm that they are all correct and click on the Install button. At this point, the AS/400 will create a network server description and storage space. It may take a few minutes, depending upon the capacity and load of your AS/400.

Once the server description is complete, the frame on the left of your browser screen will be updated to include additional icons and links. There should be several icons, including ones marked Start, Stop, Configuration, and Administration. These are the links that will be utilized most frequently.

At this point, the firewall is not started. To start it, click on the Start link located in the left frame. The right frame will be updated with a message that tells you the firewall has been started. A word of warning: What I have found in dealing with the Firewall for AS/400 is that once you have started it, it takes about 30 minutes before it becomes active. I have fallen several times into the trap of thinking that I had not configured the firewall correctly because, when I clicked on the configure link, I got an error message telling me that there was no response from the server. As a rule of thumb, give your firewall about half an hour to activate itself before you attempt to configure it. However, if it does not become active after one hour, then you may have a configuration problem.

Configuration and Administration Enablement

Note that the links for Configuration and Administration point to a different host and domain name than the Start and Stop links. This is because the Configuration and Administration links are actually being processed by the firewall, while the Start and Stop are processed by the AS/400.

The links for Configuration and Administration are built on the fly and address the firewall by the firewall name and the domain name of your AS/400. Therefore, if you named your firewall FW001 and the domain name of your AS/400 is companyx.com, then the links will point to an address like http://FW001.companyx.com/. The problem with this setup is that you have to manually resolve the FW001. companyx.com reference, as the firewall will not update a Domain Name System (DNS) server. When you first click on the Configuration link, your Web browser will return a message indicating there is no DNS entry for that host name. To circumvent this problem, place an entry in your company’s internal DNS server that resolves the name to the IP address you assigned to either of the firewall’s ports. If this is not an option for you, then you can manually edit the HOSTS file of the system you are doing the installation from. Windows 95 places its HOSTS file in the C:WINDOWS directory. It also provides a sample HOSTS file called HOSTS.SAM. You can use this file as a template for your HOSTS file.

Tailoring the Installation

At this point, you can click on the Configuration link. I recommend starting at the Basic Configuration option. This allows you to perform high-level configuration of the firewall. From there, you can perform the low-level configuration required for a secure implementation.

The Basic Configuration link will step you through what services you would like your firewall to use. Available services include proxy serving, SOCKS serving, packet filtering, and others.

Once you have completed the basic configuration, you can then click on the links associated with the different services to fine-tune them. For example, you can set up what packet filter rules you would like or the attributes of the proxy server.

Buckle Up

Like your car, the Internet can take you (and your data) to a lot of places. Minimize your chances of getting carjacked by installing and running the IBM Firewall for AS/400. As this article has demonstrated, there’s not much to it. Just make sure the hardware and software requirements are met, confirm that the Admin server instance is running, input a few parameters, and you’ll be off and running. From there, endless possibilities are available for the configuration of the firewall.

Figure 1: The IBM Firewall for AS/400 is set up and monitored through a Web browser

Description

This parameter is only important if you have multiple IPCSs installed in your AS/400. If this is the case, you can issue the command WRKHDWRSC *CMN to get the resource name of a IPCS that is currently not in use. An example resource name is CC02. During the installation, you are prompted with all available resource names.

This parameter is an arbitrary name that will be used in later configuration. The only stipulation is that it can not be the same as a Network Server description that is already created on the AS/400. The names that are already in use will be displayed when you are prompted for a name.

Lan types can be 10 Mbps Ethernet, 100 Mbps Ethernet, 4 Mbps Token-Ring, or 16 Mbps Token-Ring. This parameter should match what that network port is attached to, remembering that you have two ports on your IPCS.

An adapter address is the network interface card address, commonly known as the MAC address. Depending upon what type of LAN type you chose for that port, different stipulations will exist. You will be given these stipulations when prompted for the adapter address.

This parameter identifies the IP address that is bound to that port. This address should match the subnet of the corresponding network that the port is connected to. For example, if the one network had addresses like
192.100.150.10, then an example (not definitive) address that would be assigned is 192.100.150.1.

This parameter is a tricky one that can be either really easy or very hard to handle. If the network that the port is connected to is not using subnetting then take the default value, that the AS/400 provides from the IP address you previously entered. If you are using subnetting, then some alteration to the default will be required. If you do not know this value, then consult a network administrator in your company.

This parameter identifies the IP address of the router that provides your Internet connection. A typical configuration is that a router will be installed to convert your preferred LAN type to your connection either to the Internet or to your ISP. For example, a router may receive Ethernet packets from your firewall and convert them to ISDN or Frame Relay, which is the network type that goes to the Internet.

Variable

IPCS Hardware Resource Name

Firewall Name

Port 1 LAN Type Port 2 LAN Type

Port 1 Adapter Address Port 2 Adapter Address

Port 1 IP Address Port 2 IP Address

Port 1 Subnet Mask Port 2 Subnet Mask

Router IP Address