10
Sun, Nov
10 New Articles

Getting the AS/400 Firewall Up and Running

Security - Other
Typography
  • Smaller Small Medium Big Bigger
  • Default Helvetica Segoe Georgia Times

Originally printed in the June/July 1998 issue of MC’s AS/400 Internet Expert newsletter (now AS/400 NetJava Expert), this article provides a tutorial for the installation of IBM’s Firewall for the AS/400 product. Chris Green, AS/400 NetJava Expert’s security expert and co-author of the IBM redbook Protecting Your AS/400 from Harm on the Internet explains the requirements for the AS/400 firewall and then shows you how to install and configure it from the comfort of your favorite Web browser.

You know that if your site has any sort of Internet access at all, you need a firewall. If you don’t have a firewall up at your Internet-enabled site, might I suggest a few other activities you might enjoy: taking pans out of the oven with your bare hands, driving without a seatbelt, or skydiving with no parachute? Like the safety demonstration at the beginning of every airplane ride, this article will give you the information you need to make use of the safety equipment IBM provides. This article will show you how to install the IBM Firewall for AS/400 software and get it up and running. This will provide you with a leaping-off point from which you can configure the various components of the AS/400 firewall: proxy serving, SOCKS serving, packet filtering, the mail gateway, and others.

Prerequisites

First, I’ll outline what you need to have in place before you can install the firewall software. You’ll need a dual-port Integrated PC Server (IPCS), previously known as FSIOP. You can install the firewall software using a single-port IPCS, but from what I can deduce from the AS/400 firewall architecture, there is no functionality that will be of any benefit if you are using only one port.

IBM says the minimum requirement for the IPCS hardware is a 100 MHz Pentium with 64 MB of RAM. I personally think you need at least 128 MB of RAM. You don’t want a firewall bottleneck backing up all of your Internet communications.

Your AS/400 must be running OS/400 V4R1 or higher, which means you’ve got a RISC box. You’ll also need to have the following software components installed: TCP/IP

Connectivity Utilities (5769-TC1), Integration Services for FSIOP (5769-SA2), and Firewall for AS/400 (5769-FW1). Once all of these requirements are fulfilled, you can proceed to the installation of the firewall. You must install the software on the actual IPCS that will be dedicated to the firewall.

Getting the Admin Instance Running

From your favorite Web browser, using pages served by your AS/400, you can perform all the required administration, configuration, and installation tasks. The URL to access your AS/400’s Web administration page is your AS/400’s domain name or TCP/IP address followed by the port number of 2001.

Note that the AS/400 administration server will prompt for a valid user profile and password. Also note that access will be denied if the entered user profile does not have the appropriate authority.

Before you can use your Web browser to install the firewall, you will first need to ensure that the Admin server instance is running on the AS/400. To learn more about what a server instance is, refer to the article entitled “An Introduction to Configuring the V4R1 Web Server” in the February/March 1998 issue of AS/400 Internet Expert. For the purposes of this article, know that an AS/400 can serve multiple HTTP server instances, and each instance can each have completely unique properties and bind to different TCP/IP ports and Internet Protocol (IP) addresses.

The Admin server instance is an IBM-created instance that allows you to configure different aspects of Web serving and TCP/IP applications through a Web browser. When the IBM Firewall for AS/400 software is installed on the AS/400, the Admin instance will be updated to allow you to install the firewall. The Admin instance is directly dependent upon what software is installed on your AS/400. It will not let you configure a software component that is not installed.

To confirm that the Admin server instance is running, issue the WRKACTJOB SBS(QSYSWRK) JOB(ADMIN) command from an AS/400 command line. If no entries appear, you’ll know that the server instance is not running. To start the instance, simply issue the command STRTCPSVR SERVER(*HTTP) HTTPSVR(*ADMIN)and press Enter. After a few moments, the Admin server instance will be started.

Using the Admin Instance

Now that you have the Admin instance running, you can utilize its services. In order to do this, start your Web browser and connect to http://www.youras400.com:2001. (Of course, you’ll have to substitute www.youras400.com with the IP address or fully qualified domain name of your AS/400.) The :2001 is very important, because 2001 is the port that the Admin instance is bound to. Once you enter this URL, you will be prompted for a user ID and password. The user ID should have a minimum user class of *SECADM with *IOSYSCFG special authority. Enter the password and user ID, and click on the OK button.

If the user ID and password pair is allowed, you will be presented with the default Web page for the Admin instance (see Figure 1). If the Firewall for AS/400 licensed program (5769FW1) is installed, you should have a link entitled IBM Firewall for AS/400. Click on this to start the installation process.

What You Need to Know

The table in Figure 2 contains a list of variables and their descriptions. You will need to know what these variables do when you are installing the firewall. When a screen appears asking for a variable, it will tell you what is needed to continue, but it is a good idea to understand the parameters and what they control before you start.

Getting Down to Business

Once you have made sure you have fulfilled all the prerequisites, gotten the Admin instance running, and familiarized yourself with the parameters, you can install and start running the firewall.

Look back at your browser, which should still be pointing to the IBM Firewall for AS/400 link. In the left frame, there will be a link entitled Installation (see Figure 3). Click on this link to continue.

At this point, the right-hand frame will be updated. At the bottom of that frame, you will see a button entitled Next (see Figure 4). Once you have read the text, click on the Next button.

At the risk of being verbose or, dare I say, boring, I will briefly outline the remaining steps. As you will see from the installation, all you have to do is fill in the blanks. You should already have the parameters, so now just match the parameters that you have with the prompts that the AS/400 provides. Those of you familiar with PCs can associate these steps with a software configuration wizard.

Once you have entered the parameters and read the text for the page, click on the Next button to continue.

1. Once you click on the Next button in the first installation screen, you will be given a list of parameters required for the installation. This is similar to the table in Figure
2.

2. Select the IPCS Hardware Resource Name from the list presented.

3. A description of the IPCS that you just selected will appear. If the information is incorrect, then press the Back button and select the correct IPCS Hardware Resource Name. Otherwise, you can continue on to the next step.

4. Enter the Firewall Name.

5. Select the LAN type for port 1; one of the more common types is 10 megabits per second (Mbps) Ethernet.

6. Enter the adapter address for port 1.

7. Enter the IP address for port 1.

8. Enter the subnet mask for port 1.

9. Select the LAN type for port 2.
10. Enter the adapter address for port 2.
11. Enter the IP address for port 2.
12. Enter the subnet mask for port 2.
13. Enter the IP address of the Internet router. A confirmation screen will appear containing all the parameters you have just entered. Confirm that they are all correct and click on the Install button. At this point, the AS/400 will create a network server description and storage space. It may take a few minutes, depending upon the capacity and load of your AS/400.

Once the server description is complete, the frame on the left of your browser screen will be updated to include additional icons and links. There should be several icons, including ones marked Start, Stop, Configuration, and Administration. These are the links that will be utilized most frequently.

At this point, the firewall is not started. To start it, click on the Start link located in the left frame. The right frame will be updated with a message that tells you the firewall has been started. A word of warning: What I have found in dealing with the Firewall for AS/400 is that once you have started it, it takes about 30 minutes before it becomes active. I have fallen several times into the trap of thinking that I had not configured the firewall correctly because, when I clicked on the configure link, I got an error message telling me that there was no response from the server. As a rule of thumb, give your firewall about half an hour to activate itself before you attempt to configure it. However, if it does not become active after one hour, then you may have a configuration problem.

Configuration and Administration Enablement

Note that the links for Configuration and Administration point to a different host and domain name than the Start and Stop links. This is because the Configuration and Administration links are actually being processed by the firewall, while the Start and Stop are processed by the AS/400.

The links for Configuration and Administration are built on the fly and address the firewall by the firewall name and the domain name of your AS/400. Therefore, if you named your firewall FW001 and the domain name of your AS/400 is companyx.com, then the links will point to an address like http://FW001.companyx.com/. The problem with this setup is that you have to manually resolve the FW001. companyx.com reference, as the firewall will not update a Domain Name System (DNS) server. When you first click on the Configuration link, your Web browser will return a message indicating there is no DNS entry for that host name. To circumvent this problem, place an entry in your company’s internal DNS server that resolves the name to the IP address you assigned to either of the firewall’s ports. If this is not an option for you, then you can manually edit the HOSTS file of the system you are doing the installation from. Windows 95 places its HOSTS file in the C:WINDOWS directory. It also provides a sample HOSTS file called HOSTS.SAM. You can use this file as a template for your HOSTS file.

Tailoring the Installation

At this point, you can click on the Configuration link. I recommend starting at the Basic Configuration option. This allows you to perform high-level configuration of the firewall. From there, you can perform the low-level configuration required for a secure implementation.

The Basic Configuration link will step you through what services you would like your firewall to use. Available services include proxy serving, SOCKS serving, packet filtering, and others.

Once you have completed the basic configuration, you can then click on the links associated with the different services to fine-tune them. For example, you can set up what packet filter rules you would like or the attributes of the proxy server.

Buckle Up

Like your car, the Internet can take you (and your data) to a lot of places. Minimize your chances of getting carjacked by installing and running the IBM Firewall for AS/400. As this article has demonstrated, there’s not much to it. Just make sure the hardware and software requirements are met, confirm that the Admin server instance is running, input a few parameters, and you’ll be off and running. From there, endless possibilities are available for the configuration of the firewall.




Figure 1: The IBM Firewall for AS/400 is set up and monitored through a Web browser


Description

This parameter is only important if you have multiple IPCSs installed in your AS/400. If this is the case, you can issue the command WRKHDWRSC *CMN to get the resource name of a IPCS that is currently not in use. An example resource name is CC02. During the installation, you are prompted with all available resource names.

This parameter is an arbitrary name that will be used in later configuration. The only stipulation is that it can not be the same as a Network Server description that is already created on the AS/400. The names that are already in use will be displayed when you are prompted for a name.

Lan types can be 10 Mbps Ethernet, 100 Mbps Ethernet, 4 Mbps Token-Ring, or 16 Mbps Token-Ring. This parameter should match what that network port is attached to, remembering that you have two ports on your IPCS.

An adapter address is the network interface card address, commonly known as the MAC address. Depending upon what type of LAN type you chose for that port, different stipulations will exist. You will be given these stipulations when prompted for the adapter address.

This parameter identifies the IP address that is bound to that port. This address should match the subnet of the corresponding network that the port is connected to. For example, if the one network had addresses like
192.100.150.10, then an example (not definitive) address that would be assigned is 192.100.150.1.

This parameter is a tricky one that can be either really easy or very hard to handle. If the network that the port is connected to is not using subnetting then take the default value, that the AS/400 provides from the IP address you previously entered. If you are using subnetting, then some alteration to the default will be required. If you do not know this value, then consult a network administrator in your company.

This parameter identifies the IP address of the router that provides your Internet connection. A typical configuration is that a router will be installed to convert your preferred LAN type to your connection either to the Internet or to your ISP. For example, a router may receive Ethernet packets from your firewall and convert them to ISDN or Frame Relay, which is the network type that goes to the Internet.



Getting_the_AS-_400_Firewall_Up_and_Running05-00.png 900x679

Variable

IPCS Hardware Resource Name

Firewall Name

Port 1 LAN Type Port 2 LAN Type

Port 1 Adapter Address Port 2 Adapter Address

Port 1 IP Address Port 2 IP Address

Port 1 Subnet Mask Port 2 Subnet Mask

Router IP Address

BLOG COMMENTS POWERED BY DISQUS

LATEST COMMENTS

Support MC Press Online

$

Book Reviews

Resource Center

  • SB Profound WC 5536 Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application. You can find Part 1 here. In Part 2 of our free Node.js Webinar Series, Brian May teaches you the different tooling options available for writing code, debugging, and using Git for version control. Brian will briefly discuss the different tools available, and demonstrate his preferred setup for Node development on IBM i or any platform. Attend this webinar to learn:

  • SB Profound WP 5539More than ever, there is a demand for IT to deliver innovation. Your IBM i has been an essential part of your business operations for years. However, your organization may struggle to maintain the current system and implement new projects. The thousands of customers we've worked with and surveyed state that expectations regarding the digital footprint and vision of the company are not aligned with the current IT environment.

  • SB HelpSystems ROBOT Generic IBM announced the E1080 servers using the latest Power10 processor in September 2021. The most powerful processor from IBM to date, Power10 is designed to handle the demands of doing business in today’s high-tech atmosphere, including running cloud applications, supporting big data, and managing AI workloads. But what does Power10 mean for your data center? In this recorded webinar, IBMers Dan Sundt and Dylan Boday join IBM Power Champion Tom Huntington for a discussion on why Power10 technology is the right strategic investment if you run IBM i, AIX, or Linux. In this action-packed hour, Tom will share trends from the IBM i and AIX user communities while Dan and Dylan dive into the tech specs for key hardware, including:

  • Magic MarkTRY the one package that solves all your document design and printing challenges on all your platforms. Produce bar code labels, electronic forms, ad hoc reports, and RFID tags – without programming! MarkMagic is the only document design and print solution that combines report writing, WYSIWYG label and forms design, and conditional printing in one integrated product. Make sure your data survives when catastrophe hits. Request your trial now!  Request Now.

  • SB HelpSystems ROBOT GenericForms of ransomware has been around for over 30 years, and with more and more organizations suffering attacks each year, it continues to endure. What has made ransomware such a durable threat and what is the best way to combat it? In order to prevent ransomware, organizations must first understand how it works.

  • SB HelpSystems ROBOT GenericIT security is a top priority for businesses around the world, but most IBM i pros don’t know where to begin—and most cybersecurity experts don’t know IBM i. In this session, Robin Tatam explores the business impact of lax IBM i security, the top vulnerabilities putting IBM i at risk, and the steps you can take to protect your organization. If you’re looking to avoid unexpected downtime or corrupted data, you don’t want to miss this session.

  • SB HelpSystems ROBOT GenericCan you trust all of your users all of the time? A typical end user receives 16 malicious emails each month, but only 17 percent of these phishing campaigns are reported to IT. Once an attack is underway, most organizations won’t discover the breach until six months later. A staggering amount of damage can occur in that time. Despite these risks, 93 percent of organizations are leaving their IBM i systems vulnerable to cybercrime. In this on-demand webinar, IBM i security experts Robin Tatam and Sandi Moore will reveal:

  • FORTRA Disaster protection is vital to every business. Yet, it often consists of patched together procedures that are prone to error. From automatic backups to data encryption to media management, Robot automates the routine (yet often complex) tasks of iSeries backup and recovery, saving you time and money and making the process safer and more reliable. Automate your backups with the Robot Backup and Recovery Solution. Key features include:

  • FORTRAManaging messages on your IBM i can be more than a full-time job if you have to do it manually. Messages need a response and resources must be monitored—often over multiple systems and across platforms. How can you be sure you won’t miss important system events? Automate your message center with the Robot Message Management Solution. Key features include:

  • FORTRAThe thought of printing, distributing, and storing iSeries reports manually may reduce you to tears. Paper and labor costs associated with report generation can spiral out of control. Mountains of paper threaten to swamp your files. Robot automates report bursting, distribution, bundling, and archiving, and offers secure, selective online report viewing. Manage your reports with the Robot Report Management Solution. Key features include:

  • FORTRAFor over 30 years, Robot has been a leader in systems management for IBM i. With batch job creation and scheduling at its core, the Robot Job Scheduling Solution reduces the opportunity for human error and helps you maintain service levels, automating even the biggest, most complex runbooks. Manage your job schedule with the Robot Job Scheduling Solution. Key features include:

  • LANSA Business users want new applications now. Market and regulatory pressures require faster application updates and delivery into production. Your IBM i developers may be approaching retirement, and you see no sure way to fill their positions with experienced developers. In addition, you may be caught between maintaining your existing applications and the uncertainty of moving to something new.

  • LANSAWhen it comes to creating your business applications, there are hundreds of coding platforms and programming languages to choose from. These options range from very complex traditional programming languages to Low-Code platforms where sometimes no traditional coding experience is needed. Download our whitepaper, The Power of Writing Code in a Low-Code Solution, and:

  • LANSASupply Chain is becoming increasingly complex and unpredictable. From raw materials for manufacturing to food supply chains, the journey from source to production to delivery to consumers is marred with inefficiencies, manual processes, shortages, recalls, counterfeits, and scandals. In this webinar, we discuss how:

  • The MC Resource Centers bring you the widest selection of white papers, trial software, and on-demand webcasts for you to choose from. >> Review the list of White Papers, Trial Software or On-Demand Webcast at the MC Press Resource Center. >> Add the items to yru Cart and complet he checkout process and submit

  • Profound Logic Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application.

  • SB Profound WC 5536Join us for this hour-long webcast that will explore:

  • Fortra IT managers hoping to find new IBM i talent are discovering that the pool of experienced RPG programmers and operators or administrators with intimate knowledge of the operating system and the applications that run on it is small. This begs the question: How will you manage the platform that supports such a big part of your business? This guide offers strategies and software suggestions to help you plan IT staffing and resources and smooth the transition after your AS/400 talent retires. Read on to learn: