.gif){kind=spacer} |
 IPX/IP
Gateway
A supplement to Novell's CNE Study Set -- IntranetWare/NetWare 4.11
Featuring:
With the IPX/IP Gateway, outside Web servers view all requests coming through the Gateway as having originated from the IntranetWare server's IP address. Then, all TCP/IP traffic returning to the Gateway can be forwarded to the appropriate Novell client using IPX rather than IP. This second phase of Figure 540-5 is accomplished using a special version of WINSOCK.DLL installed on the client. For example, suppose a Novell client using Netscape Navigator requests a host name such as www.cyberstateu.com. The Navigator requests WINSOCK.DLL to resolve and open a connection to the host name. The IPX/IP Gateway uses DNS to convert www.cyberstateu.com to the appropriate IP address (206.127.205.131). The Gateway then exchanges data between Novell's Web server and the requesting client, adding and stripping IPX headers as necessary to ensure reliable IP communications. Because the IPX/IP Gateway uses only a single IP address, the private network is safe from outside interference. This creates a natural "firewall." WINSOCK is an interface between Microsoft Windows and the TCP/IP protocol stack. It isn't actually part of TCP/IP, although we've been using it for so long that it seems as though it is. IP connectivity provided by Novell's IPX/IP Gateway offers many benefits. First and foremost, it avoids the need to install and manage IP addresses on each user's workstation. This removes many of the individual management hassles that occur when maintaining TCP/IP workstations -- for example unique IP addresses, subnet mask data, default router addresses, and Domain Name Servers. Second, the IPX/IP Gateway avoids using additional memory on workstations for each TCP/IP stack. Third, it integrates seamlessly with the existing IPX and NDS WAN infrastructure. And finally, the IPX/IP Gateway provides simplified security by "fire-walling" all incoming and outgoing IP communications through a single gateway address. In this section, we're going to explore a variety of IPX/IP Gateway installation and management tasks. Here's a quick preview: Installing the IPX/IP GatewayLet's learn more about how to use Novell's IPX/IP Gateway as a bridge from our small IPX-based village to the high-speed information superhighway. The IPX/IP Gateway is part of Novell's Internet Access Server (NIAS). NIAS is the foundation of our global electronic village. In addition to IPXGW.NLM, NIAS includes two related IP connectivity solutions: NetWare MultiProtocol Router 3.1 (MPR) and WAN Extensions 3.1. With these products, your IPX/IP Gateway can communicate with the outside world using Frame Relay, Integrated Services Digital Network (ISDN), Leased Lines, and/or X.25. If you plan to use the IPX/IP Gateway as part of an outbound WAN connection to an ISP, you must have a WAN interface board and Customer Premise Equipment (CPE). Of course, the faster your WAN connection, the faster you'll speed along the Internet superhighway. As I mentioned earlier, the IPX/IP Gateway is installed automatically as part of Novell's Internet Access Server (NIAS). For detailed installation instructions, consult Novell's CNE Study Guide for IntranetWare/NetWare 4.11, pages 1147-1150. Once you've installed NIAS and the IPX/IP Gateway, you're ready to hop onto the information superhighway. This is accomplished by configuring the Gateway for your specific needs. Let's take a closer look. Configuring the IPX/IP Gateway The IPX/IP Gateway is initially disabled by default. You can enable the Gateway by using the INETCFG.NLM utility at the IntranetWare console. Check out Figure 540-6 for a peek at the IPX/IP Gateway Configuration screen within INETCFG.NLM. Keep in mind, this screen is available only after you've installed Novell's Internet Access Server (NIAS).
For detailed steps on configuring the IPX/IP Gateway, read Novell's CNE Study Guide for IntranetWare/NetWare 4.11, pages 1151-1153. Adding IPX/IP Gateway Tools to NWADMIN Once you've enabled and configured the IPX/IP Gateway, an NDS Gateway Server object appears in the NDS tree. By default, it is created in the same context as the server on which it was installed. The Gateway object's name is the same as the server's name, with a "-gw" appendage. For example, ACME's Gateway object in the LABS container is called "LABS-SRV1-GW" From a user's standpoint, the IPX/IP Gateway object allows clients to easily find and use active IP tunneling servers. More importantly, from a CNE perspective, it allows you to manage the Gateway Server from within NDS. However, first you'll need to add the Gateway's Snap-In utility to NetWare Administrator (NWADMIN). The IPX/IP Gateway Snap-In utility only works with the 16-bit version of NetWare Administrator -- NWADMN3X.EXE. This utility is designed for Windows 3.1x workstations and stored in the SYS:PUBLIC subdirectory. Windows 95 users can still use the utility, but they are limited to 16-bit functions. To add IPX/IP Gateway support to the 16-bit NWADMIN utility, complete the steps in Novell's CNE Study Guide for IntranetWare/NetWare 4.11, pages 1153-1154. Once NWADMN3X.EXE has been configured for IPX/IP Gateway services, the "Unknown" Gateway object will appear as an Internet Server icon. You can view details about the object by double-clicking on the icon or by selecting Object and Details from the main menu. The Snap-In utility also adds two new user attributes to NDS: IPX/IP Gateway Service Restrictions and IPX/IP Gateway Host Restrictions. These attributes can be used by CNEs to designate which Internet services or hosts are available through the IPX/IP Gateway. Controlling Access to the IPX/IP Gateway Once the IPX/IP Gateway server has been fully installed and configured, you can use NetWare Administrator to restrict Internet access to appropriate NDS objects only -- such as users, groups, and/or containers. As a protocol translator, the IPX/IP Gateway is perfectly suited to enforce restrictions on traffic between the local IPX network and the IP-based Internet. For more information on controlling access to the IPX/IP Gateway, check out Novell's CNE Study Guide for IntranetWare/NetWare 4.11, pages 1154-1155. Of the two IPX/IP Gateway access restrictions, Service Restrictions are by far more powerful. They instruct the Gateway object as to which applications may be used and when. IntranetWare supports four different types of Service Restrictions:
Using the IPX/IP Gateway Client Users can take full advantage of the IPX/IP Gateway by using an updated version of Client 32. You can install this special Gateway version of Client 32 from the NIAS CD-ROM or directly from an IntranetWare server. Although the Client 32 software only requires about 6MB of hard disk space, the software installation process requires 14MB because temporary files are copied during installation. The IPX/IP Gateway version of Client 32 adds two important features:
In addition, here's a quick note about Microsoft protocol support. If Microsoft TCP/IP is an installed and configured protocol, you must disable the IPX/IP Gateway before using TCP/IP for WINSOCK applications. Also, make sure you close all WINSOCK applications before using the Switcher to disable the IPX/IP Gateway. Installing the IPX/IP Gateway Client for Windows 3.1 IPX/IP Gateway support is installed as an option during the Client 32 workstation installation. Begin with a "Normal" Client 32 installation for Windows 3.1, as explained in Novell's CNE Study Guide for IntranetWare/NetWare 4.11, pages 1182-1185. During the Client 32 installation process, an Additional Options screen will appear. To customize the client for IPX/IP Gateway services, complete the steps in Novell's CNE Study Guide for IntranetWare/NetWare 4.11, pages 1155-1156. Installing the IPX/IP Gateway Client for Windows 95 IPX/IP Gateway support is activated as an option during the Client 32 workstation installation. Begin by installing the "Normal" Client 32 for Windows 95 software, as shown in Novell's CNE Study Guide for IntranetWare/NetWare 4.11, pages 1179-1182. To activate the IPX/IP Gateway Client for Windows 95, you'll need to use the Customize button during Client 32 workstation installation. Complete the steps detailed in Novell's CNE Study Guide for IntranetWare/NetWare 4.11, pages 1156-1157. When the IPX/IP Gateway client is enabled, a Gateway Support Task is
automatically run. The Gateway client uses NOVGWP16.EXE for Windows 3.1
and NOVGWPRC.EXE for Windows 95. The Gateway Support Task runs minimized
in Windows 3.1 and appears in the task bar in Windows 95. This application
should never be closed, as it provides valuable information about the status
of the Gateway.
Speaking of Gateway status, now seems like a good time to explore some valuable troubleshooting tips . . . (in the rare event something should go wrong). Believe me, there's nothing virtual about a flat tire on the information superhighway. It hurts just as much in cyberspace as in the real world. Troubleshooting the IPX/IP Gateway Even if you lead a charmed cyber-life, you're bound to have a few problems with the IPX/IP Gateway. That is the nature of our global electronic village. Get used to it! Fortunately, the IPX/IP Gateway records valuable troubleshooting information in two automated log files:
If (or when) you run across any problems using the IPX/IP Gateway, it would help to have access to a virtual cyberspace toolbelt. As an IntranetWare CNE, you'll be on the hot seat should the global electronic villagers have any problems accessing the outside world. To help out, here's a list of common Gateway problems and solutions: IPX/IP Gateway does not respond to clients attempting to use it.
IPX/IP Gateway fails to connect to or locate a given IP address.
One of the most obvious problems is the validity of the IP address itself. You can use WinPing to test the address and reliability of Internet connectivity. This includes cabling, routers, filtering, and the existence of intermediate firewalls. Finally, if the IPX/IP Gateway tries to connect but times out, it may be due to a high level of traffic congestion to and from the Gateway. Or it's quite possible that the Internet itself is "clogged." It happens! IPX/IP Gateway connects to a host but fails to support an application
or service.
Finally, a lack of Gateway application support may be a symptom of a larger problem. In many cases, too much data traffic can cause bandwidth bottlenecks between the client and the Internet host. IPX/IP Gateway provides unreasonably slow service.
The final problem, however, is your responsibility. If the IPX/IP Gateway is not performing optimally, you may want to consider increasing its internal resources. For example, the quality of the server CPU can have a dramatic impact on the performance of IPX/IP translation. More commonly, a lack of memory causes users' requests to be queued. Remember, the NIAS server requires an additional 4 MB of memory and 500 KB for each set of 100 TCP/IP connections. Finally, you may want to set the users' expectations appropriately. They may not be aware that the Gateway's translation of IPX/IP packets causes a slight performance penalty. This problem is enhanced when the Gateway is heavily used. This completes our discussion of IntranetWare's IPX/IP Gateway. Hopefully, you've gained an appreciation for the immense value of a single translation point between you and the global electronic village. Most importantly, all your villagers can access the information superhighway without the added overhead of TCP/IP workstation software. This provides you with security, centralized management, and general peace of mind. So far, we've installed Novell's Internet Access Server, learned all about the architecture of TCP/IP, and created an on-ramp to the information superhighway -- in the form of Novell's IPX/IP Gateway. Of course, once you're cruising down the information superhighway, you need a place to go. That's the purpose of Novell's Web server. Check it out . . . Forward to The Novell Web Server Back to Understanding IntranetWare TCP/IP Back to Cramsession |
||||||||||||||||||||||||||||||||
Figure
540-5: The IPX/IP Gateway
Figure
540-6: IPX/IP Gateway Configuration in INETCFG.NLM