TN3270: Limiting Users by Port Value

Last reviewed: November 15, 1995
Article ID: Q139675

The information in this article applies to:

Microsoft SNA Server version 2.11

SUMMARY

By default, the SNA Server TN3270 server allows a client to connect using any port value and IP address. While it is possible to configure the range of IP addresses that have access to a pool or LU, TN3270 server always hard codes the port value range to (00000, 65535). There is no way to change this using the TN3270 Admin program.

WORKAROUND

To implement checking on a given port range, the TN3270 server configuration file (TNSVRCFG.TNC) must be manually edited.

For example:

This sample TN3270 configuration file shows one TN3270 pool configured to allow any client Internet protocol address or client port number access to the LUA LUs in the pool.

   [SNA Resource 1]
   Name=TNTEST
   Sessions=16
   MaxSessions=16
   TerminalName1=IBM-3276-3
   TerminalName2=IBM-3278-3
   TerminalName3=IBM-3278-3-E
   TerminalName4=IBM-3279-3
   TerminalName5=IBM-3279-3-E

   [Group 1]
   Name=TNTEST
   Comment=
   SNAResource1=TNTEST
   IPConnection1=000.000.000.000,000.000.000.000,00000,65535

To modify the available port numbers change the last two numbers (00000,65535) to the desired range.

Example Two:

   [SNA Resource 1]
   Name=TNTEST
   Sessions=16
   MaxSessions=16
   TerminalName1=IBM-3276-3
   TerminalName2=IBM-3278-3
   TerminalName3=IBM-3278-3-E
   TerminalName4=IBM-3279-3
   TerminalName5=IBM-3279-3-E

   [Group 1]
   Name=TNTEST
   Comment=
   SNAResource1=TNTEST
   IPConnection1=000.000.000.000,000.000.000.000,50000,60000

This sets the allowable client port range to 50000-60000. Any client attempting to connect with a different local port number will be denied. If this occurs, the following TN3270 errors will occur:

On the client machine:

   Warning 512
   TN3270 Service Error 512
   Access for IP address <client IP address> port <client port number>
   is not configured.

On the server machine:

   Warning 603
   TN3270 session with client at <client IP address> <port <client port
   number>> using LU <LU name> terminated abnormally because:

   Access for IP address <client IP address> <port <client port number>> is
   not configured.
   Explanation: A TN3270 client session was terminated abnormally.

   Action: No action is necessary.

KBCategory: kbnetwork kbinterop
KBSubcategory: ntnetserv ntprotocol
Additional reference words: prodsna 2.11

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.

Last reviewed: November 15, 1995
© 1998 Microsoft Corporation. All rights reserved. Terms of Use.