KB190446 - Restricting access to TN3270 LUs

Article ID: 190446

Article Last Modified on 12/4/2007

Microsoft SNA Server 3.0 Service Pack 4
Microsoft SNA Server 4.0
Microsoft SNA Server 3.0 Service Pack 2
Microsoft SNA Server 3.0 Service Pack 3
Microsoft SNA Server 4.0
Microsoft SNA Server 4.0 Service Pack 1
Microsoft Host Integration Server 2000 Standard Edition
Microsoft Host Integration Server 2000 Service Pack 1
Microsoft Host Integration Server 2004 Standard Edition

This article was previously published under Q190446

SUMMARY

To restrict access to TN3270 LUs configured for SNA Server or Host Integration Server, add the IP addresses or names of the workstations to which you want to grant access in the IP Address List of the LU properties in SNA Server Manager. Depending on the information (name, IP address, subnet mask) that is entered in the IP Address List, you can restrict the LU to one specific IP address or a range of addresses on the network.

NOTE: If no IP address or name restriction is configured for a TN3270 LU, then the LU is implicitly made available for use by any TN3270 client who attempts to connect to the server.

MORE INFORMATION

Restricting access by IP address

When an IP address and subnet mask is added to the IP Address List, the LU can be restricted to the workstation with that specific IP address, or to any workstation on the same network. SNA Server will logically "AND" the IP address with the subnet mask, to determine what workstation IP addresses are allowed access to the LU. The process of ANDing involves converting the IP address and subnet mask to binary numbers and adding the two together. The examples below illustrate this concept:

   IP Address = 010.100.004.022  Subnet Mask = 255.255.000.000

   IP Address   00001010  01100100  00000100  00010110
   Subnet Mask  11111111  11111111  00000000  00000000
                --------------------------------------
   Result       00001010  01100100  00000000  00000000

The AND result in decimal is 010.100.000.000 Therefore, addresses 010.100.000.001 - 010.100.255.254 have access to the LU.

   IP Address = 010.100.004.022  Subnet Mask = 255.255.255.255

   IP Address   00001010  01100100  00000100  00010110
   Subnet Mask  11111111  11111111  11111111  11111111
                --------------------------------------
   Result       00001010  01100100  00000100  00010110

The AND result in decimal is 010.100.004.022. Therefore, this is the only address that has access to the LU.

   IP Address = 131.107.100.001  Subnet Mask = 255.255.240.0

   IP Address   10000011  01101011  01100100  00000001
   Subnet Mask  11111111  11111111  11110000  00000000
                --------------------------------------
   Result       10000011  01101011  01100000  00000000

The AND result in decimal is 131.107.096.000. Therefore, addresses 131.107.096.001 - 131.107.111.254 have access to the LU.

Restricting access by name

If a name is entered in the IP Address List for the TN3270 LU, SNA Server will resolve the name to the workstation using NetBios name resolution. There is no option to add a subnet mask. To use this feature, the TN3270 server must be configured with the Use Name Resolution check box, and the TCP/IP name resolution method (for example, DNS, WINS, and so on) must be able to support ?IP address to name? lookups. If not, the TN3270 client computer must be able to respond to a NETBIOS ?node status query? request. To find the TN3270 client's name, the TN3270 server uses the GetHostByAddr() sockets function.

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

138086 Windows NT 3.51: Reverse name resolution for WINS clients

Additional query words: HIS 2000 HIS2004

Keywords: kbinfo KB190446