Firewall Concepts and Configuration - HP Operations Manager

Known Issues in NAT Environments
Firewall Configuration in OVO
Network Address Translation
In a NAT environment, the following problems can be encountered.
FTP Does Not Work
Problem
There is a general problem with FTP in a NAT environment. This will
cause the OVO agent installation mechanism to fail. The following
scenarios might occur:
❏ The Installation to Microsoft Windows nodes just hangs for a while
after entering the Administrator’s password.
❏ The UNIX installation reports that the node does not belong to the
configured operating system version.
This issue can be verified by manually trying FTP from the OVO
management server to an agent outside the firewall. The FTP login will
succeed but at the first data transfer (GET, PUT, DIR), FTP will fail.
Possible error messages are:
500 Illegal PORT Command
425 Can’t build data connection: Connection refused.
500 You’ve GOT to be joking.
425 Can’t build data connection: Connection refused.
200 PORT command successful.
hangs for about a minute before reporting
425 Can’t build data connection: Connection timed out.
Usually, FTP involves opening a connection to an FTP server and then
accepts a connection from the server back to the client on a
randomly-chosen, high-numbered TCP port. The connection from the
client is called the control connection, and the one from the server is
known as the data connection. All commands and the server’s responses
go over the control connection, but any data sent back, such as directory
lists or actual file data in either direction, go over the data connection.
Some FTP clients and servers implement a different method known as
passive FTP to retrieve files from an FTP site. This means that the client
opens the control connection to the server, tells the FTP server to expect
a second connection and then opens the data connection to the server
itself on a randomly-chosen, high-numbered port.
Chapter 1 45