Subject: Re: plug-gw logs deny=(source host)

From: "T. Esting" <[email-masked]>
Date: Wed, 11 Apr 2001 14:22:41 -0700 (PDT)

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

   Any chance peanut is a CNAME?  plug-gw is very particular about host name
matching.

On Wed, 11 Apr 2001 12:34:38 -0700, Miller, Richard  M. wrote:

 >  [To be removed from this list send the message "unsubscribe fwtk-users"
in the
 >  BODY of a mail message to [email-masked].]
 >  
 >  I'm trying to setup plug-gw to proxy (and I use the term lightly) between
 >  two networks that have no route to each other, but have a route to my
 >  service network (DMZ). These networks are in extranet format and in no
way
 >  are connected to the internet.   There are very little routes in either
 >  direction and each host can sucessfully initiate traffice to my plug-gw
box.
 >  
 >  
 >  I've configured the fwtk to use only plug-gw in the following manner:
 >  
 >  (netperm-table) 
 >  
 >  sna-gw: port sna-print peanut plug-to sna-print-host1 -port sna-print  
 >  
 >  where:  sna-print is definded as port 8023 in my services file, and
peanut
 >  is the host that i'm testing from., and sna-print-host1 is the
destination
 >  of the print jobs ( a FEB running TN3270E for a printer session)
 >  
 >  
 >  (line from services file)
 >  
 >  sna-print       8023/tcp
 >  
 >  
 >  plug-gw is configured to start from inetd:
 >  
 >  (line from inetd.conf)
 >  sna-print stream tcp nowait root /usr/local/etc/plug-gw sna-gw sna-print
 >  
 >  
 >  When I configure a sna print session with a valid LU and destination, the
 >  stream gets denied by plug-gw.  Keep in mind these networks have free and
 >  clear access to my proxy box, but not each other. This is running on
solairs
 >  7 on sun hardware with all the latest patches.  Complied with GNU gcc and
 >  GNU make on a full developer distribution load (on another dev box) and
 >  seems to startup fine.  Netstat shows my box listening on port *.8023
(there
 >  are four IP address's bound to hme0) and I get the following entries in
 >  /var/adm/messages
 >  
 >  Apr 10 11:23:17 proxy1 plug-gw[1671]: deny host=peanut/10.223.35.21
 >  service=sna-
 >  print
 >  Apr 10 11:45:44 proxy1 plug-gw[1672]: deny host=peanut/10.223.35.21
 >  service=sna-
 >  print
 >  
 >  It's clear to me that plug is denying the connection, even though
"peanut"
 >  is explicitly allowed in the netperm table.  scoured the Internet and
can't
 >  find any evidence that another service from the fwtk needs to be running.
 >  Could this be the case??
 >  
 >  I'm stumped.
 >  
 >  
 >  This is driving me crazy, if anyone can help me I'd be willing to drive
to
 >  you and take you out for lunch if your in No. California...LOL!!
 >  
 >  
 >  thx in advance.
 >  
 >   
 >  
 >  
 >  Richard Miller
 >  Sr. Network Analyst
 >  SF Network Engineering Group 
 >  Banc of America BrokerDealer Services
 >  (formally Montgomery Correspondant Services)
 >  Banc of America Securities, LLC
 >  655 Montgomery Street
 >  San Francisco, Ca. 94111
 >  Phone: 415.913.4223
 >  Cell: 510-517-8555
 >  Fax: 415.913.6542
 >  eMail: [email-masked]
 >  
 >  
 >  
 >  
 >  _____________________________________________________________________ 
 >  IMPORTANT NOTICES: 
 >            This message is intended only for the addressee. Please notify
the
 >  sender by e-mail if you are not the intended recipient. If you are not
the
 >  intended recipient, you may not copy, disclose, or distribute this
message
 >  or its contents to any other person and any such actions may be unlawful.
 >  
 >           Banc of America Securities LLC("BAS") does not accept time
 >  sensitive, action-oriented messages or transaction orders, including
orders
 >  to purchase or sell securities, via e-mail.
 >  
 >           BAS reserves the right to monitor and review the content of all
 >  messages sent to or from this e-mail address. Messages sent to or from
this
 >  e-mail address may be stored on the BAS e-mail system.
 >  
 >

_______________________________________________________
Send a cool gift with your E-Card
http://www.bluemountain.com/giftcenter/