IBM AS/400 connection via SNASW on Cisco Router

Question

TL; DR: How can I connect two old AS/400 machines via SNA when the only transport mechanism between the physical locations is IP? AnyNet isn't an option, see below.

A friend of mine and I have two IP networks linked together with an IPSEC Site2Site-VPN utilizing Cisco-Routers. Works like a charm. Since I have more VPN uplinks, a Cisco ASA filters out unwanted traffic flows at my side.

We also run two old IBM AS/400 9401-150 with OS/400 V4R5. One at my site, one at his'. We use distinct SNA network id names (instead of the default "APPN"). The two machines are linked together with the AnyNet-Capability of OS/400. Basically this works, aping works, sndnetf and sndnetmsg are nice to play with. But I suspect that the Cisco ASA in between loses track of the established TCP or UDP session sometimes. Sometimes, the SNA-Session backed by IP recovers, sometimes not. To get the SNA connection to a working state again, I need to vary off the controller descriptions on both sides; most often with the force-parameter, since one side sometimes doesn't permit varying off the *ctld "at this time".

Anyway, I want to get rid of AnyNet and use Enterprise Extender.
Unfortunately, EE isn't available in V4R5, it's just too old. But Cisco IOS is capable of doing this, on certain platforms with a certain feature set in a firmware image.

I do have two Cisco 2500 at hand with the needed IBM Networking Image. So I configured IOS to build a link via Ethernet LLC to my AS and the same mirror-like at my friends site. Configuration excerpt:

snasw event implicit-ls port cpcp
snasw cpname POCNET.DSLRTR
snasw port LAN GigabitEthernet0/0.1
snasw port TFR hpr-ip Loopback0 vnname POCNET.POCNET
snasw link NIBBLER port LAN rmac 0004.acde.9369 nns
snasw link FRIENDRT port TFR ip-dest 172.31.178.65

The APPC *ctld on the AS' are created automatically and run fine. I can successfully aping both adjacent routers from the respective AS/400.

I also added two loopback interfaces on the router, defined another port (TFR) and built a link between these two. Link is up, no sessions are started. Somewhat expectable.

      SNA Links                                                            HPR
      Link Name   State    Port Name Adjacent CP Name  Node Type     Sess  Sup
      ---------  --------  --------- ----------------  ------------  ----  ---
   3> FRIENDRT   Active    TFR       FRIEND.FRIENDRT   End Node         0  Yes
   4> NIBBLER    Active    LAN       POCNET.NIBBLER    Network Node     2  Yes

This is the point where I'm stuck. I expect to get LU6.2-Sessions from one AS via the adjacent router to the other router which get finally forwarded to the destination AS. This isn't happening.

I poked in the fog a bit, tested with aping to the other side's cisco router and the other side's AS/400, but no avail:

• Added an entry to the QAPPNRMT configuration lists of both machines to destination *any with the respective remote net id. The remote cpname is the adjacent cisco router.
• An APPC *devd is automatically created and varied on, though.
• Created an APPC *ctld type *vrtappn but didn't find how to tell this *ctld to route the session via the adjacent cisco router.

The configuration is in parts derived by studying IBM "iSeries Networking APPC, APPN, and HPR" and Cisco "Bridging and IBM Networking Configuration Guide 12.4".

First, if I'm wrong here, please tell me which subsite of StackExchange is more appropriate. Since all components I use are nearly 20 years old, it made sense to me to ask here.

Please refrain from pointing out to use IP as transport between the machines. First, some applications just have no option to utilize IP as transport. Second and most important: These boxes are old and slow and a single ftp session over the 10Mbit/s NIC brings these boxes down to their knees. SNA transport is much more lightweight. That's the main intention for me, trying to utilize SNA, or to be more precise, a PU2.1 connection between the AS' and their routers while the data itself (utilizing LU6.2 between the AS') is transported via HPR/IP between the cisco routers.

Maybe I'm completely on the wrong track and that's just not how EE works. The entire SNA stuff is rather complicated and I still have an awful lot of puzzle pieces still waiting to fall in place to show a picture I can understand. :-)

Would anyone please be so kind and create the tags AS400 and Cisco? Since I'm a newbie here, I'm not allowed (yet).

Answer 1

There are two changes necessary to the existing configuration to make this work (basically):

• Change both AS/400 Network attributes so they are both *ENDNODE,
• Change both AS/400 Network attributes so they're automatically selecting a Netserver (NN) to query for names: NETSERVER(*LCLNETID *ANY)
• Remove one link configuration to the adjacent Cisco router on one side only.
• Remove the link configuration on the other Cisco router. Wait a minute and re-add the connection with the nns statement. This instructs the router to do name searches over this connection on the adjacent router.
• There's also no need to have a QAPPNRMT configuration list (entry).

Let APPN do it's exchanges for peer discovery and after a minute or so the connection works.

Basically, the configuration must not be symmetric; this was the main culprit. Even if IBM states APPN is true peer-to-peer networking, this isn't true for the topology at whole. The most important thing is to observe how both routers negotiate their adjacent peer.

Passive side:

   SNA Topology Entries
    Dest. Node Name   Type  TG#      TG Type             TG Status
   -----------------  ----  ---  ----------------  ---------------------
1> FRIEND.FRIENDRT    Enpt   21  Downlink to BrNN  CP-CP sessions active 
2> POCNET.NIBBLER     Enpt   21  Downlink          CP-CP sessions active

Active side:

   SNA Topology Entries
    Dest. Node Name   Type  TG#      TG Type             TG Status
   -----------------  ----  ---  ----------------  ---------------------
1> POCNET.DSLRTR      Intr   21  Uplink            CP-CP sessions active 
2> FRIEND.SLVRLAKE    Enpt   21  Downlink          CP-CP sessions active 

Unfortunately it seems that Cisco devices talking to each other in Enterprise Extender Mode isn't very reliable. Both Cisco-Routers sometimes throw errors that the link went down when it wasn't. The adjacent router didn't recognize this alleged outage, so the connection seems to be established but hangs.

So I replaced the EE-link over the VPN between the sites with Remote Source Route Bridging over TCP. This incorporates virtual ring interfaces which are surprisingly still available even on recent IOS versions. See this Network Diagram for better understanding. I renamed FRIENDxx on the right side with APPN so it's more readable.

Changstein is a passive device for SNA, it just Source-Route bridges Ring 1 (where one AS/400 resides) into the Virtual-TokenRing 0 interface of dslrtr.

Nibbler (left AS/400) creates an APPN connection with the MAC of Virtual-TokenRing 0 to the SNAsw facility on dslrtr.

Viewed from right, slvrlake also creates an APPN-Session to rtka01. There's only Ethernet in that location.

Both dslrtr and rtka01 participate in a virtual ring over RSRB/TCP. Both SNAsw-facilities on both routers connect to their adjacent counterpart via the appropriate Virtual-TokenRing interface. Remember, only one router (here: rtka01) must initiate the connection!

This configuration makes sure that bridged traffic stays as much local as possible. Cisco SNAsw works a a high-level protocol router for APPC sessions and also indirectly as protocol converter between SNA/APPN and IP, so the traffic can flow over the IP-only VPN.

I also reduced the maximum frame size in several places (in the Cisco configuration only) because stock Ethernet cannot handle the large frame sizes which Token Ring permits.

When experimenting with APPN, be aware that topology updates take their time. Stuff which doesn't work may work a few minutes later without touching anything. Recognizing this helped a lot with proper debugging and repeatable outcomes.

For reference:

• Cisco SNAsw Guide
• Cisco RSRB Guide