Hi there,

I'm new to this forum and a little bit confused about the structure. So maybe I've chosen the wrong one. Just tell me and I will repost it elsewhere.

We have the IBM debugger for z/OS (version 15) running on our system. It works without any problem and we are happy with it.

But now our security department wants to change some network infrastructure in that way, that only client connection initiation to the mainframe are allowed. So for example FTP is no problem. The client asks the mainframe for the connection establishment and the mainframe sends the data.

Exception is the z/OS debugger. At the moment we have the configuration that if I start a batch program with the debug information, the mainframe tries to open a connection to the client. If Eclipse is running, that client accepts the connection and the debugging begins.

Question: as far as you know, is there another possible configuration of the z/OS debugger, that the client establishes the connection to the mainframe and the mainframe accepts that and the debugging starts?

Hello!
I am assuming that you mean using the TCPIP option in the TEST runtime option. 
The better way to debug is using the Debug Manager .  In short, when a user connects via RSE, they become registered to the Debug Manager, then when one uses DBMDT instead of TCPIP in the TEST runtime option, z/OS Debugger relays the debug session to the Debug Manager which then routes the debug session via the RSE connection back to the client to the appropriate user.  In this way, the connection between the user to z/OS is initiated from the IDE and is incoming to z/OS, and not initiated from z/OS outbound to the IDE.  This link describes the flow with a diagram:
https://www.ibm.com/docs/en/developer-for-zos/17.0.x?topic=reference-understanding-debug-manager
Hope that helps!