ftp question

[tim lloyd_1]

Hi, I support an Itanium system running VMS 7.2. The controlling node currently uses FTP to copy configuration data to slave nodes (there are 4 linked computers running identical software on VMS7.2).

It also uses FTP to warehouse files to a 3rd party computer.

Recently the customer swapped around the computer used as the controlling node. The FTP job to the slave nodes still works however the FTP to the 3rd party computer encounters -

%FTP-E-NETERR, I/O error on network device
-SYSTEM-F-REJECT, connect to network object rejected

I can ping the 3rd party computer. Is there another step required on VMS to allow FTP access?

[Jon Pinkley]

"Recently the customer swapped around the computer used as the controlling node."

Did this change the ip address? If so, perhaps the 3rd party computer is only allowing specific ip addresses to connect to its ftp server.

Jon

[John Gillings]

REJECT usually means the protocol isn't recognised on the target system, or the target system doesn't want to let you in. The diagnosis needs to be done on the target system. Think about it, if you're being attacked you don't want to give away too much information to the attacker.

See HELP/MESSAGE REJECT

REJECT, connect to network object rejected

Facility: SYSTEM, System Services

Explanation: A request to connect to an object at a remote node failed for
one of the following reasons:

o The object requested does not exist.

o The access control information specified is invalid.

o The partner NSP has no resources.

o The partner task exited during the connect sequence.

o The partner task rejected the connect.


User Action: Determine which reason caused the failure and try to correct
the condition.

[tim lloyd_1]

Hi Jon. Yes, this change meant a different IP address for the controlling computer. I believe they have added the new address to their router but I am not sure whether they have a specific FTP server. I will take this up with them. Many Thanks

[tim lloyd_1]

and thanks John. I will work through this checklist with the customer.

[Andy Bustamante]

I'd follow up on Jon's point. If the source address has changed, you need to ensure routing, firewall rules at source and destination, and target host configuration all allow FTP. FTP traffic, especially the default active FTP, can be very sensitive to network access configurations.

Andy Bustamante

[P Muralidhar Kini]

Hi Tim,

In case FTP is disabled on the 3rd party computer then any request to FTP
to that machine will result in
%TCPIP-E-FTP_NETERR, I/O error on network device
-SYSTEM-F-REJECT, connect to network object rejected

Check whether the FTP service is enabled on the 3rd party computer
$@sys$startup:tcpip$config
-> FTP Client
-> FTP Server

If the FTP service is enabled then the problem may be that the 3rd party
computer is not accepting the connections from the controlling node.

Regards,
Murali

[Steven Schweda]

> In case FTP is disabled on the 3rd party
> computer [...]

That's where I'd start. "SYSTEM-F-REJECT"
corresponds to "connection refused" in
UNIX-land. It may be possible to get that
from a clever firewall, but the usual
explanation is that there's no FTP server
running/configured on the server system.

Trying to contact the FTP server from that
same system would tend to evade most firewall
restrictions.


> I can ping the 3rd party computer. [...]

Not a routing problem then.

[labadie_1]

Hi Tim

>>> support an Itanium system running VMS 7.2

Humm
IMHO, either an Alpha system with VMS 7.2 or an Itanium with VMS 8.2