3Com 4500 UDP_Helper

[DZuroff]

I have two AS400 controllers connected to VLAN 1 on my network and I have a utility that searches for the controllers via UDP port 1110. If I run the utility on a PC in VLAN 1 I see the controller list. If I run the utility on a PC in VLAN 2 I do not see the controller list list. How do I configure UDP-Helper to allow me to scan for and detect the controllers on VLAN 1 from a PC on VLAN 2? I have multiple 4500 switches but in this case the PC and controllers are connected to the same switch.

I also have the same type of controllers at remote sites and the remote network is connected to the host network via VPN however each remote site is on a flat network (no vlans) but different subnets than the host network. Can I somehow allow the remote controllers to be detected from VLAN 2 on the host network? The switches at the remote sites are 3Com 4400 switches.

I will try and break it down giving actual IP addresses for each device:

Host Network: Controller - 10.3.1.7 (Vlan1); PC - 10.3.2.1 (Vlan2)

Remote networks: Controllers - 10.4.1.3, 10.5.1.3, 10.8.1.7 (each IP is a different subnet in a different location connected via VPN)

 

[IRudebwoy]

In the system view

udp-helper enable
udp-helper 1110

In the VLAN view

udp-helper server 10.3.1.7

Which I assume is the IP address of the AS400 controller.

How is your remote site connected to your main site??

Happy hunting!

 

[DZuroff]

I had tried exactly what you advised but it does not work. When I scan the subnet for the controllers nothing appears in the list.

The remote sites are connected using an IPSec site-to-site VPN tunnel.

Site1 (10.4.1.0) -> VPN -> corporate site (10.3.0.0)
Site2 (10.5.1.0) -> VPN -> corporate site (10.3.0.0)
Site3 (10.8.1.0) -> VPN -> corporate site (10.3.0.0)

 

[IRudebwoy]

Can you put wireshark on a PC in VLAN2 (I assume it's MS Windows) to see what is being sent and where?

When you scan the subnet does it scan every address or does it use the broadcast?

And maybe mirror the uplink port on VLAN1 and put a packet sniffer (PC with wireshark) on it to see if the traffic is crossing the VLAN.

As far as the remote site, in theory, you would need to bridge VLAN2 between the two sites. I've done it with a pair of Cisco (blasphemy in a 3com forum, oh well) routers to extend a DMZ to a remote site without it's own internet connection. It was over a dedicated point-to-point ATM circuit but I think the same technique might apply. 3Com switches were used at both ends.

Another method would be to add the ethernet port(s) of the VPN device(s) as an untagged member of VLAN2 which will force all traffic to the remote sites through VLAN2 and may have adverse consequences.

What device(s) are you using for your VPN?