SUMMARY : Solaris 2.4 ftp and SunOS 4.1.x ftp across firewall

From: hduc@airmoon.epa.nsw.gov.au
Date: Wed May 03 1995 - 08:42:14 CDT


Again Casper Dik provides the solution to my problem.

I attached here the two possibilities that Casper suggested. I followed
the first one and ftp Solaris 2.4 client is working like a charm.

Also thank to Kevin Sheehan.

 My orignal question is

> >
> >I recently upgraded our machine from SunOS 4.1.3 to Solaris2.4. The
> >machine is behind a firewall. Under SunOS , the ftp client can connect to
> >outside hosts on the Internet without problem. I can transfer files.
> >
> >The ftp client does not work to outside hosts on the Internet under
> >Solaris 2.4. It can connect but the host server side can not build a
> >data connection channel.
> >
> >What is difference between the SunOS ftp client and Solaris one ?. The
> >firewall administrator said that all other ftp clients on DEC, HP
> >workstations are working fine. So it must be something wrong with the
> >Solaris one.
>

Casper Dik suggestion :
 
Not necessarily. The Solaris 2.x use higher number ports (> 32K)
which may cause problems. A second problem might be the don't
fragment bit on all outgoing packets.
 
With the following commands you'll be only using ports 1024-20000
(default is 32K-64K)
ndd -set /dev/tcp tcp_smallest_anon_port 1024
ndd -set /dev/tcp tcp_largest_anon_port 20000

If this works, then your firewall allows incoming connections to
ports < 32K but not to ports > 32K
 
 
5.15) Solaris 2.x can't set up any TCP/IP connections to certain hosts.
 
     Solaris 2.x sets the don't fragment bit on all packets it send
     as part of MTU path discovery. The Solaris 2.x implementation
     is RFC compliant, but the MTU path discovery protocol will
     fail when there are broken routers in the path.
     Typical symptom is not being able to connect from a
     Solaris 2.x hosts but having no trouble from other hosts or
     being able to start a TCP/IP connection but not move any
     significant amount of data.
 
     /usr/sbin/ndd -set /dev/ip ip_path_mtu_discovery 0
 
     (See also 5.14)
 



This archive was generated by hypermail 2.1.2 : Fri Sep 28 2001 - 23:10:23 CDT