IBM RSA through firewall, blank screen in remote control

As mentioned, I have read those posts and articles concerning the ports.  I have both tcp and udp open on port 2000 as an added measure.

Also as mentioned, I've tried several client computers and browsers on the outside world, with no success.  I've also tried several computers and browsers from the inside network, and it *does* work.

All outbound communication is allowed through the firewall (I'm not having issues with other outbound applications).  

One article mentions the outbound is some random port over 1024 from the RSA to the client.  Could the *remote* firewall (i.e., the firewall closest to the client device) be blocking the traffic for KVM control?

I've seen other posts talking about the blank/black screen, but no good solution (several mention firmware, but I'd imagine I would have the same blank/black screen from the inside network as well).

Thanks.

If you are seeing the same black/blank screen issues on multiple clients on the outside world it may very well be firmware.

Don't count out firmware as a possible fix. Being that internal computers can connect to the Remote console with no issue does not mean the firmware is NOT the culprit. THe data packets that the RSA sends out over a network can be adversly affect by switches routers, and firewalls.

If there are multiple firewalls between the RSA and the outside world there very well could be a issue with one of the other firewalls like a mis-configured rule, pr a missing rule that is not allowing traffic over port 2000. I would try updating the RSA firmware first.

Also if you have access to teh firewall logs I would look through them and see if the IP of the client that is making the request is being accepted by the firewall or rejected.

My laptop works on the inside network and does not work from the outside.  The firewall is a SonicWall TZ170, with limited logging (that I can find).

The firmware on the RSA and the system (x3500 type 7977) is all latest/greatest, updated within the last week.

I've tested several other RSA's I have in the field with the same result - black screen from outside network.

I have RSA's behind a SonicWall, a Cisco 1700, and a Watchguard x750e (all at different locations) -- all give me black screens.  Each location has a different ISP and connection medium (cable, DSL, wireless) as well.

Any thoughts?

Have you tried changing MTU value on the firewall; from outside network, do this simple test:
ping <public-ip> -f -n <size>

Start with 1500 as value for -n and decrease by 100 for every unsuccessful try; finally play around with the value to find the maximum optimum value.

Normally we change MTU value on client but as you are experiencing problem at multilpe locations, suggesting to look at the value on firewall.

Please check and update.

Thank you.

Checking the MTU issue out.  I know one location has an MTU of 1492 due to DSL issues.  The other locations have T1 or cable, with no changes to MTU.

Can the MTU be changed on the RSA (not in front of it to check at the moment)?

Not sure about the RSA server itself; normally on a windows machine you use DrTCP [http://www.dslreports.com/drtcp] and change the MTU.

Thank you.

umm...the RSA has it's own NIC...would the MTU on the Windows driver affect the RSA?  I'm guessing they have their own TCP stack and MTU?

Not 100% sure; can someone more experienced with RSA please comment here.

Thank you.

Following up on this...does no one else have issues with RSA's through NAT?

Can someone at least confirm it to be an issue?  Has anyone replicated this?

IBM has been less-than-helpful on this issue.

Thanks again!

The IBM RSA is a self contained mini-computer within the server. IT setting are completely separate from the server and the OS. This is the same for Dell DRAC, and HP iLO.

I dont think the problem is with your IBM RSA card. I think the issue lies within one of the firewalls. More than likely the firewall closes to the IBM server. From what I can make out one of the firewalls is still blocking the port needed for Console access.

I am not sure if you can do this or not, but see if you can change the port that the IBM RSA uses for Console access to a known port that you know works through the firewall.

Will try that, but for clarification, the doc says 80/tcp and 2000/tcp only.  I've done both tcp/udp.  Are there any other ports I need to open?

I've got this behind Cisco, Watchguard, and Sonic Wall firewalls.  It seems odd that they'd all exhibit the same behavior.

First, note that this happens on Cisco and non-Cisco products - if that changes anything.

I tried a couple of things - I changed the port to 5090 per the post, then restarted the RSA.  I got the same thing.  Then, I noticed that the popup window for Remote Control had http://<ip>:80, instead of the port specified in the RSA.  So, I tried browsing to the RSA on 5090 (i.e., http://<ip>:5090).  I get a logon and the web interface.  Remote control still doesn't work on my laptop (which works on the inside network to the same RSA).

I tried an XP machine with no version of Java installed to force it to install Java.  I browse to either port 80 or to port 5090 and choose Remote Control and I get a "Connection to host lost".

I'm going to do some more experimenting

I had to rip out and redo the acket filters on a Watchguard.  With (2) RSA's on the inside mapped to a single public IP on the outside, I set RSA1 to port 81 for http and 5090 for remote control.  RSA2 is set on port 82 for http and 5091 for remote control.  I created NAT mappings for those ports on the public IP.  I still have to use java 1.4.2_19 from the outside, but it works!  Thanks for the help!!!