IBM and RSA II / RSA II SL adaptor problems

[ChevyChase12000]

Hi All,

Bit of a complex and long winded one this but if you've got IBM servers and rely on RSA cards for your remote support I'd very much appreciate you taking the time to have a look at this - it may even apply to you.

I'm currently working on a site with maybe 700+ IBM servers with RSA II / RSA II Slimline cards installed in each of them.

These are great for the support teams for obvious reasons, however there's a major fly in the ointment. Some of the cards, sometimes, don't work.

By "don't work" I mean that you can ping them but you cannot gain access via the web interface or a telnet session.

This has been a problem here for quite some time without being flagged - if a support operative tries to access a server via the RSA card and it doesn't work he simply assumes it's not installed correctly and makes a visit to the server itself - without reporting the issue.

There has been a process underway for some time investigating this (IBM are involved). The servers and RSA cards are flashed with the most recent versions of firmware and have all the most recent drivers installed.

What I'm would really like to know is:

1) Are you experiencing the same problems? - You may not actually realise if you are because of the nature of the problem - a quick chat within your support teams should give you an indication - "does RSA access *always* work"?

2) Do you have a specific "management lan" setup for RSA cards and the like or are they attached to your "normal" network?

Even if you're not having the problem I'd be interested to find out how your network is configured regarding these cards.

This is a massive issue for us here so any feedback would be most appreciated.

Many, MANY thanks to those who reply!

 

[itsp1965]

My environment unfortunately is not as large as yours, but we rely heavily on the cards also. From my experience;

- When you say you can ping them but not access the web interface or telnet. I have seen this happen a few times. A lot of times this is due to misconfiguration of subnet mask in the network settings of the card. Download ASU from developerworks website which allows you change settings of the RSA adapter from within Windows
- Issues accessing remote control sessions. Usually caused by incompatible Java versions on client machines. Anything higher than version 1.3 is supported.
- I hate to say this I think IE is better supported when connecting than Firefox when connecting to the web interface
- Each connection has a dedicated IP address and network connection (no daisy chaining RS-485 connections)
- Make sure desktop or network firewalls block access. RSA uses a few ports and they are specified in tech document on the IBM redbooks site.

Hope this helps.

Regards

Terry

 

[ChevyChase12000]

Thanks for that Terry,

Unfortunately the settings have all been verified as correct (by IBM).

Portpings to port 80 and 23 using TCP packets and UDP packets show that the cards that "stop working" no longer respond to TCP packets (although UDP works fine - and obviously ICMP as pinging them works).

I'll have a look at ASU though - changing the settings from within windows would be most handy anyway!

Thanks!

Anyone else?

 

[KobeW]

Hello,

I recently had the same problem and discovered that all the cards came out of the box with the same MAC address, 0008.0406.1234.

This is fine if your servers are on different subnets, but if they're on the same subnet it causes intermittent connectivity.

I've been told that to fix it, you need use the locally administrated address on each card.

Exactly where this is or how to do it, I'm not sure. The closest thing I've been able to find is using the MPCLI, with the getnethw and setnethw commands. The -adminmac option lets you set the network-administrator-assigned MAC address, or setting it to all zeros forces it to use the hardware address.

The user manual with the commands and syntax is at:

ftp://ftp.software.ibm.com/pc/pccbbs/pc_servers_pdf/d3basmst.pdf

Hope this helps,
Kobe

 

[iamwu]

Hi guys

We are seeing a very similar problem using the IBM RSA II Slimline adapter. Can you confirm whether this issue is still outstanding?

Wu

 

[itsp1965]

Try downloading the ASU utility which queries RSA cards for their configuration. You can then modify any parameters that don't jive.
Also there is a new firmware available for all RSA cards (which includes fixes for the DST issue) which might solve some of your problems.
Hope this helps.

 

[ChevyChase12000]

Right then chaps. You'll find that this is *all* IBM's fault. There is a problem with their firmware which means that the cards simply fall over intermittently.

This has been addressed for *most* server platforms in a new firmware release. If you want to check whether that platforms release has the fix in it you can check the "change log" description which accompanies each firmware release.

Look for "improved the handling of 'invalid network data'" or something about improving the code to prevent DOS-style attack.

The fact that both of those reasons are total bollocks is beside the point - the fix *should* stop the cards falling over by themselves, for no reason other than pap IBM code.


I've come across the mac address problem too. If you can work around it then great - if not then return your cards to IBM and demand they fix/replace them - it's a "known issue".

 

[iamwu]

Thanks guys.

I'm in touch with IBM now and will see what their response is to this matter.

All the best.

William

 

[Groovrider]

IBM have release a tip for the MAC Address issue.

RETAIN Tip: H187408

It can found by searching for the tip number in Google

http://www-304.ibm.com/jct01004c/sy...ocdisplay?lndocid=MIGR-65530&brandind=5000020