IBM i Global

IBM i 

A space for professionals working with IBM’s integrated OS for Power systems to exchange ideas, ask questions, and share expertise on topics like RPG and COBOL development, application modernization, open source integration, system administration, and business continuity.


#Power


#IBMi
#Power
#Operatingsystems
#Servers
 View Only

  • 1.  Binding to a particular IP address

    Posted 08/22/23 10:50 AM

    I have a DMZ lpar with multiple addresses of 208.x.x.x on subnet 255.255.255.0
    I have an internal lpar at address 10.y.y.y on subnet 255.255.254.0
    The *DFTROUTE for the DMZ lpar is 208.x.x.1, subnet *NONE.
    The DMZ lpar supports multiple interfaces (IP addresses).  However I would like all traffic from the DMZ lpar to this one internal lpar to bind from address 208.x.x.2
    Is it as easy as adding another route like:
    ADDTCPRTE RTEDEST('10.y.y.y') SUBNETMASK('255.255.254.0') NEXTHOP('208.x.x.1') BINDIFC('208.x.x.2') TEXT('Route for BRMS to SGCTLKIT')
    On the ADDTCPRTE I believe I use the subnet mask of the destination and not the subnet mask of the source, right?
    Sounds easy but I had a bad experience years ago trying to set up Schowler routes and I am a little cautious since.

    I know that a few IBM i applications have their own way of "bind specific".  This app is not one of them.  And none of the other IP addresses have any business talking to this destination.



    ------------------------------
    Robert Berendt IBMChampion
    ------------------------------


  • 2.  RE: Binding to a particular IP address

    Posted 08/22/23 11:51 AM

    Hello Robert, you have to use *HOST in the SUBNETMASK value.



    ------------------------------
    Juan Martin Araya Carrasco
    ------------------------------



  • 3.  RE: Binding to a particular IP address

    Posted 08/22/23 01:52 PM

    Thank you.

    I've added the appropriate route.

    I ran a traceroute before/after and no changes.

    I can still do 3 part naming sql so that's good.

    The real test will be when we tighten the firewall to ensure that only the one IP address can get in.



    ------------------------------
    Robert Berendt IBMChampion
    ------------------------------

    Original Message


  • 4.  RE: Binding to a particular IP address

    Posted 08/24/23 10:29 AM

    I think you've got it.  If you establish a connection to that host, you can see which interface is being used as a source address with NETSTAT *CNN on either side (assuming its IBM i on both sides)



    ------------------------------
    Vincent Greene
    IT Consultant
    Technology Expert labs
    IBM
    Vincent.Greene@ibm.com


    The postings on this site are my own and don't necessarily represent IBM's positions, strategies or opinions.
    ------------------------------

    Original Message


  • 5.  RE: Binding to a particular IP address

    Posted 08/23/23 08:51 AM

    I think you've got it with the BINDIFC parameter.  We're using SRIOV so I have 2 "physical" interfaces with a bunch of virtual interfaces built on top of them.  We use BINDIFC(*NONE) so the system will use either of the physical interfaces.  If one goes down, it will use the other.  In your case you're trying to do the opposite (force traffic to a particular destination to bind to a specific local interface).



    ------------------------------
    Steven Riedmueller
    Certified IBM i Admin
    Speaker, Mentor, and Advocate
    ------------------------------



  • 6.  RE: Binding to a particular IP address

    Posted 08/23/23 09:08 AM

    We have a very fault tolerant setup.  Ethernet is served from multiple VIOS lpars using multiple FC adapters, etc.  Still shows up as one line description to that lpar of IBM i.  So it's not like binding to one particular IP address chokes down any of our fault tolerances.  The other IP addresses are simply for stuff like

    https://functiona.dekko.com

    https://functionB.dekko.com

    ...



    ------------------------------
    Robert Berendt IBMChampion
    ------------------------------

    Original Message


  • 7.  RE: Binding to a particular IP address

    Posted 08/23/23 09:20 AM

    Yup I think that's definitely the way to go these days.  Our setup was done by a business partner when SRIOV was what all the "cool kids" were doing!



    ------------------------------
    Steven Riedmueller
    Certified IBM i Admin
    Speaker, Mentor, and Advocate
    ------------------------------

    Original Message


  • 8.  RE: Binding to a particular IP address

    Posted 08/24/23 10:25 AM

    The cool kids all do vNIC these days.  That's SRIOV adapters with VIOs managing an automatic failover.  

    more here:  https://blog.vios4i.com/search/label/vNIC



    ------------------------------
    Vincent Greene
    IT Consultant
    Technology Expert labs
    IBM
    Vincent.Greene@ibm.com


    The postings on this site are my own and don't necessarily represent IBM's positions, strategies or opinions.
    ------------------------------

    Original Message


Related Content