Domino IP traffic routing?

I have posted previous messages about problems concerning the Agent.RunOnServer() method. I think this issue may be a routing issue through our firewall.

I’m not sure if anyone can help, in this matter, but I’ll throw this out as a general question.

We have had problems trying to get an agent to talk to our Mainframe DB2 DB when calling it via the RunOnServer method. The agent runs fine if it is scheduled, or called via the web. But if it is called from an internal Notes client, it hangs.

The Domino server is protected from the internet via a firewall, and there is a “DMZ” positioned between Domino and our Mainframe system. If I open up a web browser, and point it at our Domino server, the admin can see inbound traffic coming in through the firewall in port 80. And, if I call the agent in question, he can see outbound traffic going to the DB2 server on our mainframe via a specified port in the DMZ. If we schedule the agent, the admin can again see the outbound DB2 traffic going through the DMZ.

However, if I open up the Notes client and access the Domino server, the admin does not see any inbound traffic coming through the firewall, and when I execute the agent as RunOnServer() there is no outbond traffic going from Domino to the DMZ.

The admin can see port traffic in the firewall on port 1352, but that is going to our Domino Mail server inside our organization.

I’m thinking that when I come in via the client, I’m coming in on some unknown port, the Domino server does not know how to route traffic from this port through the DMZ to DB2.

Does this sound plausible? What other ports should we be looking at, or is this totally up to our network admin? Is there possibly another issue at work here? Has anyone had a similar experience?

Thank you for your input.

Previous Posts:

http://www-10.lotus.com/ldd/nd6forum.nsf/ShowMyTopicsAllFlatweb/6eaf47dd6840671185256fd9005b29e9?OpenDocument

http://www-10.lotus.com/ldd/nd6forum.nsf/ShowMyTopicsAllFlatweb/892754b62b55faff85256fe300659d2c?OpenDocument

Subject: Domino IP traffic routing ??

When running an Agent from a client it uses the ‘Current ID’.

When running via Web or Schedule it is the ‘Agent Signer’ or ‘Run on behalf of’

Is the Client user ID able to run the trigger agent. Probably is, but just need to rule this out.

Subject: RE: Domino IP traffic routing ??

Yes, the user can trigger the agent. The agent is also signed with an ID that is capable of running the agent.

We can see displays written to the log from the agent up to the time it tries to issue a connectto() command to DB2.

Subject: RE: Domino IP traffic routing ??

Hi,

I can’t help you with this agent, BUT, domino connections are allways using NRPC (1352/TCP). No other ports will be used.

Ask your admin to check if your client is trying to get any other connection.

HTH,

Daniel

Subject: RE: Domino IP traffic routing ??

Prior to reading your response, I got a reply from my admin, in that he said he’d like to put a hub in between the Domino server and the DMZ to sniff the traffic using his laptop at the time the call from Domino to DB2 is supposed to be occurring.

Wouldn’t he also need to see what connection he is getting from the firewall to the Domino server as well?

Subject: RE: Domino IP traffic routing ??

Yes, but his idea is a good one. Not secure, but for testing purposes for a short time can be very helpfull

Daniel

Subject: RE: Domino IP traffic routing ??

My admin is going to test this over the next few days. I’ll post any results/questions that may arise.

Thanks again.

Subject: RE: Domino IP traffic routing ??

Hello Bruce

Did you ever find an answer? I am experiencing the same problem.

Thanks!

Subject: Related response here

I posted a possible solution on one of your related topics here:

http://www-10.lotus.com/ldd/nd6forum.nsf/ShowMyTopicsAllFlatweb/16ea4d14444c8bbc85257152002d37c7?OpenDocument