Microsoft KB Archive/190446

= Restricting access to TN3270 LUs =

Article ID: 190446

Article Last Modified on 12/4/2007

-

APPLIES TO


 * Microsoft SNA Server 3.0 Service Pack 4
 * Microsoft SNA Server 4.0
 * Microsoft SNA Server 3.0 Service Pack 2
 * Microsoft SNA Server 3.0 Service Pack 3
 * Microsoft SNA Server 4.0
 * Microsoft SNA Server 4.0 Service Pack 1
 * Microsoft Host Integration Server 2000 Standard Edition
 * Microsoft Host Integration Server 2000 Service Pack 1
 * Microsoft Host Integration Server 2004 Standard Edition

-



This article was previously published under Q190446



SUMMARY
To restrict access to TN3270 LUs configured for SNA Server or Host Integration Server, add the IP addresses or names of the workstations to which you want to grant access in the IP Address List of the LU properties in SNA Server Manager. Depending on the information (name, IP address, subnet mask) that is entered in the IP Address List, you can restrict the LU to one specific IP address or a range of addresses on the network.

NOTE: If no IP address or name restriction is configured for a TN3270 LU, then the LU is implicitly made available for use by any TN3270 client who attempts to connect to the server.



Restricting access by IP address
When an IP address and subnet mask is added to the IP Address List, the LU can be restricted to the workstation with that specific IP address, or to any workstation on the same network. SNA Server will logically "AND" the IP address with the subnet mask, to determine what workstation IP addresses are allowed access to the LU. The process of ANDing involves converting the IP address and subnet mask to binary numbers and adding the two together. The examples below illustrate this concept:    IP Address = 010.100.004.022  Subnet Mask = 255.255.000.000

IP Address  00001010  01100100  00000100  00010110 Subnet Mask 11111111  11111111  00000000  00000000 --  Result       00001010  01100100  00000000  00000000 The AND result in decimal is 010.100.000.000 Therefore, addresses 010.100.000.001 - 010.100.255.254 have access to the LU.    IP Address = 010.100.004.022  Subnet Mask = 255.255.255.255

IP Address  00001010  01100100  00000100  00010110 Subnet Mask 11111111  11111111  11111111  11111111 --  Result       00001010  01100100  00000100  00010110 The AND result in decimal is 010.100.004.022. Therefore, this is the only address that has access to the LU.    IP Address = 131.107.100.001  Subnet Mask = 255.255.240.0

IP Address  10000011  01101011  01100100  00000001 Subnet Mask 11111111  11111111  11110000  00000000 --  Result       10000011  01101011  01100000  00000000 The AND result in decimal is 131.107.096.000. Therefore, addresses 131.107.096.001 - 131.107.111.254 have access to the LU. 

Restricting access by name
If a name is entered in the IP Address List for the TN3270 LU, SNA Server will resolve the name to the workstation using NetBios name resolution. There is no option to add a subnet mask. To use this feature, the TN3270 server must be configured with the Use Name Resolution check box, and the TCP/IP name resolution method (for example, DNS, WINS, and so on) must be able to support ?IP address to name? lookups. If not, the TN3270 client computer must be able to respond to a NETBIOS ?node status query? request. To find the TN3270 client's name, the TN3270 server uses the GetHostByAddr sockets function.

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

138086 Windows NT 3.51: Reverse name resolution for WINS clients

Additional query words: HIS 2000 HIS2004

Keywords: kbinfo KB190446

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.