Cisco IOS Bridging and IBM Networking Command Reference, Volume 2 of 2, Release 12.2

TN3270 Server Commands

Use the commands in this chapter to configure and monitor the Cisco Mainframe Channel Connection (CMCC) products, which include the Channel Interface Processor (CIP) and the Channel Port Adapter (CPA). For hardware technical descriptions and for information about installing the router interfaces, refer to the hardware installation and maintenance publication for your particular product.

Note Unless otherwise specified, all commands in this chapter are supported on the Cisco 7000 with RSP7000, Cisco 7500 and the Cisco 7200 series routers.

For interface configuration information and examples, refer to the "Configuring the TN3270 Server" chapter of the Cisco IOS Bridging and IBM Networking Configuration Guide.

For a conversion table of the modular products and Cisco 7000 family processors, refer to the "Platform Support" appendix of the Cisco IOS Configuration Fundamentals Command Reference.

allocate lu

To assign logical units (LUs) to a pool, use the allocate lu listen-point PU configuration command. To remove LUs assigned to a pool, use the no form of this command.

allocate lu lu-address pool poolname clusters count

no allocate lu lu-address pool poolname clusters count

Syntax Description

Defaults

No default behavior or values.

Command Modes

Listen-point PU configuration

Command History

Usage Guidelines

The following guidelines apply to the allocate lu command:

•The LUs assigned to a pool constitute a cluster. When multiple pools are configured, the LU ranges for different pools on the same PU must not overlap.

•A maximum of 255 LOCADDRs can be allocated to a pool. Configurations with invalid LOCADDRs are deleted. Overlapping LU ranges between different pools are invalid.

•The LOCADDR ranges must not overlap for multiple allocation statements and with existing ranges specified for client nailing statements.

•When LUs are allocated while LUs are in use, existing clients are allowed to complete their sessions unaffected.

Examples

In the following example, the starting LOCADDR is 10. Each cluster has 5 LOCADDRs, therefore 25 LOCADDRs (10 through 34) are allocated to the pool name LOT1.

interface channel 0/2

 tn3270-server

  pool LOT1 cluster layout 4s1p

  listen-point 10.20.30.40

   pu PU1

    allocate lu 10 pool LOT1 clusters 5

As a result of this configuration, the following LOCADDRs are created in each cluster:

•Cluster 1

–LOCADDR 10—Screen

–LOCADDR 11—Screen

–LOCADDR 12—Screen

–LOCADDR 13—Screen

–LOCADDR 14—Printer

•Cluster 2

–LOCADDR 15—Screen

–LOCADDR 16—Screen

–LOCADDR 17—Screen

–LOCADDR 18—Screen

–LOCADDR 19—Printer

All of the LUs in these clusters are allocated to pool LOT1.

Related Commands

certificate reload

To configure SSL Encryption Support enabled to read the profile security certificate from the file specified in the servercert command, use the certificate reload profile configuration command.

certificate reload

Syntax Description

This command has no arguments or keywords.

Defaults

No default behavior or values.

Command Modes

Profile configuration

Command History

Usage Guidelines

There is not a no form for this command.

The TN3270 server must be configured for security.

Examples

The following example configures the TN3270 server with SSL Encryption Support to read the profile security certificate from the file specified in the servercert command:

certificate reload

Related Commands

client ip

To add an IP subnet to a client subnet response-time group, use the client ip response-time configuration command. To remove an IP subnet from a client subnet response-time group, use the no form of this command.

client ip ip-address [ip-mask]

no client ip ip-address [ip-mask]

Syntax Description

Defaults

No default behavior or values.

Command Modes

Response-time configuration

Command History

Examples

Following is an example of the client ip command:

tn3270-server

response-time group acctg

 client ip 10.1.2.3 255.0.0.0

Related Commands

client ip lu

To define a specific LU or range of LUs to a client at the IP address or subnet, use the client ip lu TN3270 PU configuration mode command. To cancel this definition, use the no form of this command.

client [printer] ip ip-address [ip-mask] lu first-locaddr [last-locaddr]

no client [printer] ip ip-address [ip-mask] lu first-locaddr [last-locaddr]

Syntax Description

Defaults

No LUs are nailed. They are all available to any client.

Command Modes

TN3270 PU configuration mode

Command History

Usage Guidelines

This command is valid only on the virtual channel interface. Multiple statements can be configured for one IP address or nail type either on one PU or multiple PUs. But each LU can only appear in one client statement.

A client with a nailed IP address can request one of the nailed LUs via the TN3270 device name. If the requested LU is not available then the connection is rejected.

A client with a nailed IP address cannot request an LU outside the range of nailed LUs for its type (screen or printer).

A client with a nonnailed IP address cannot request an LU that is configured as nailed.

The command will be rejected if some of the locaddrs are already nailed. If the locaddrs are currently in use by other remote clients, the nailing statement will take effect only when the locaddr is made available.

To cancel the definition, the no client form of the command must be entered exactly as the client command was originally configured. If a range of locaddrs was specified, to cancel this definition the whole range of locaddrs must be specified. There is no way to cancel only one locaddr if a whole range of locaddrs was configured.

Examples

In the following example, locaddrs 1 to 50 are reserved for remote devices in the 171.69.176.0 subnet:

interface channel 2/2

 tn3270-server

 pu BAGE4

  client ip 171.69.176.28 255.255.255.0 lu 1 50

In the following example, locaddrs 1 to 40 are reserved for screen devices in the 171.69.176.0 subnet, while 41 to 50 are reserved for printers in that subnet:

interface channel 2/2

 tn3270-server

 pu BAGE4

  client ip 171.69.176.28 255.255.255.0 lu 1 40

  client printer ip 171.69.176.28 255.255.255.0 lu 41 50

In the following example, there is an attempt to cancel a definition but this is rejected because it does not specify the full range of locaddrs and the second attempt fails to specify the correct nail type:

interface channel 2/2

 tn3270-server

  pu BAGE4

  client printer ip 171.69.176.50 255.255.255.0 lu 1 100

  no client printer ip 171.69.176.50 255.255.255.0 lu 1

  %Invalid LU range specified

  no client ip 171.69.176.50 255.255.255.0 lu 1 100

  %client ip 171.69.176.50 nail type not matched with configured nail type printer 

Related Commands

client ip pool

To nail clients to pools, use the client ip pool listen-point configuration command. To remove clients from pools, use the no form of this command.

client ip ip-address [ip-mask] pool poolname

no client ip ip-address [ip-mask] pool poolname

Syntax Description

Defaults

No default behavior or values.

Command Modes

Listen-point configuration

Command History

Usage Guidelines

If the pool is configured while LUs are in use, existing clients are allowed to complete their sessions. A pool name can be identical to an LU name. When assigning an LU, the TN3270 server searches the LU name space first for specific requests, such as connections that specify a device name on CONNECT or LU name in the terminal type negotiation. The request is assumed to be directed to the specific LU rather than to the pool. Make sure the name spaces do not clash.

Examples

The following is an example of the client ip pool command that nails the client at IP address 10.1.2.3 with an IP mask of 255.255.255.0 to the pool named OMAHA:

tn3270-server

 pool OMAHA cluster layout 10s1p

 listen-point 172.18.4.18

  client ip 10.1.2.3 255.255.255.0 pool OMAHA

Related Commands

client lu maximum

To limit the number of LU sessions that can be established for each client IP address or IP subnet address, use the client lu maximum TN3270 server configuration command. To remove a single LU limit associated with a particular IP address, use the no form of this command.

client [ip [ip-mask]] lu maximum number

no client [ip [ip-mask]]

Syntax Description

Defaults

The default is that there is no limit on the number of concurrent sessions from one client IP address.

The default value for the ip-mask argument is 255.255.255.255.

In the no form of this command, the default value for the number argument is 65535.

Command Modes

TN3270 server configuration

Command History

Usage Guidelines

This command is valid only on the virtual channel interface. An instance of the client (lu limit) command on a given tn3270-server is uniquely identified by the ip-mask and the logical AND of the ip-address with that mask. For example, if the command is entered as the following:

client 10.1.1.62 255.255.255.192 lu maximum 2

Then it will be stored (and subsequently displayed by write term) as:

client 10.1.1.0 255.255.255.192 lu maximum 2

The maximum specified on the command can be changed simply by reissuing the command with the new value. It is not necessary to remove the command first.

When you use the no client command, only the corresponding client lu maximum statement is removed, as identified by the IP address and IP address mask combination. You cannot use no client to specify an unlimited number of LU sessions. The lu number keyword is optional in the no form of the command.

For example, if a service bureau has 8000 clients and each client IP address is limited to four LU sessions, you will never need more than 32000 concurrent LU definitions even when the service is running at 100 percent capacity.

Examples

The following example limits all clients to a maximum of two LU sessions:

client lu maximum 2

The following example limits a client at IP address 10.1.1.28 to a maximum of three LU sessions:

client 10.1.1.28 lu maximum 3

The LU limit can be applied to different subnets as shown in the following example. The most exact match to the client IP address is chosen. Clients with IP addresses that reside in the subnet 10.1.1.64 (those with IP addresses in the range of 10.1.1.64 through 10.1.1.127) are limited to a maximum of 5 LU sessions while other clients with IP addresses in the subnet 10.1.1.0 are limited to a maximum of 4 LU sessions.

client 10.1.1.0  255.255.255.0 lu maximum 4

client 10.1.1.64 255.255.255.192 lu maximum 5

The following example prevents an LU session for the client at IP address 10.1.1.28:

client 10.1.1.28 lu maximum 0

Related Commands

client pool

To nail clients to pools, use the client pool listen-point configuration command. To remove clients from pools, use the no form of this command.

client {[ip ip-address [ip-mask]] | [name DNS-name [DNS-domain-identifier]] | [domain-name DNS-domain] | [domain-id DNS-domain-identifier]} pool poolname

no client {[ip ip-address [ip-mask]] | [name DNS-name [DNS-domain-identifier]] | [domain-name DNS-domain] | [domain-id DNS-domain-identifier]} pool poolname

Syntax Description

Defaults

No default behavior or values.

Command Modes

Listen-point configuration

Command History

Usage Guidelines

If the pool is configured while LUs are in use, existing clients are allowed to complete their sessions. A pool name can be identical to an LU name. When assigning an LU, the TN3270 server searches the LU name space first for specific requests, such as connections that specify a device name on CONNECT or LU name in the terminal type negotiation. The request is assumed to be directed to the specific LU rather than to the pool. Make sure the LU names do not conflict.

Examples

Nailing Clients to Pools by IP Address

The following is an example of the client pool command with the ip keyword configured. The command nails the client at IP address 10.1.2.3 with an IP mask of 255.255.255.0 to the pool named OMAHA:

tn3270-server

 pool OMAHA cluster layout 10s1p

 listen-point 172.18.4.18

 client ip 10.1.2.3 255.255.255.0 pool OMAHA

Nailing Clients to Pools by Device Name

The following is an example of the client pool command with the name keyword configured. The command nails the client at device name george-isdn29.cisco.com to the pool named GENERAL:

tn3270-server

  pool GENERAL  cluster layout 4s1p

  listen-point 172.18.5.168

   pu T240CA   91922363 token-adapter 31 12 rmac 4000.4000.0001

    allocate lu 1 pool GENERAL  clusters 1

  client name george-isdn29.cisco.com pool GENERAL

Nailing Clients to Pools by Device Name using a Domain ID

The following is an example of the client pool command with the name keyword and the optional DNS-domain-identifier argument configured. The command nails the client at device name lucy-isdn49.cisco.com to the pool named GENERAL:

tn3270-server

 domain-id 23 .cisco.com

  pool GENERAL  cluster layout 4s1p

  listen-point 172.18.5.168

   pu T240CA   91922363 token-adapter 31 12 rmac 4000.4000.0001

    allocate lu 1 pool GENERAL  clusters 1

 client name lucy-isdn49 23 pool GENERAL

Nailing Clients to Pools by Domain Name

The following is an example of the client pool command with the domain-name keyword configured. The command nails any client at domain name .cisco.com to the pool named GENERAL:

tn3270-server

  pool GENERAL  cluster layout 4s1p

  listen-point 172.18.5.168

   pu T240CA   91922363 token-adapter 31 12 rmac 4000.4000.0001

    allocate lu 1 pool GENERAL  clusters 1

 client domain-name .cisco.com pool GENERAL

Nailing Clients to Pools by Domain Name Using a Domain ID

The following is an example of the client pool command with the domain-id keyword configured. The command nails any client at domain name cisco.com to the pool named GENERAL:

tn3270-server

 domain-id 23 .cisco.com

  pool GENERAL  cluster layout 4s1p

  listen-point 172.18.5.168

   pu T240CA   91922363 token-adapter 31 12 rmac 4000.4000.0001

    allocate lu 1 pool GENERAL  clusters 1

 client domain-id 23 pool GENERAL

Related Commands

default-profile

To specify the name of the profile to be applied as a default to all the listen points, use the default-profile security command. To disable the default profile specification, use the no form of this command.

default-profile profilename

no default-profile profilename

Syntax Description

Defaults

No default profile.

Command Modes

Security configuration

Command History

Usage Guidelines

If this command is configured, this profile name and all of its attributes will be associated with all listen points that do not specify an individual profile with the sec-profile command.

Profile names cannot be duplicated.

Entering the no form of this command removes the default specification and any listen points that do not have the sec-profile command specified will revert to a non-secure mode.

This command has no retroactive effect. If a listen point is specified using the listen-point command, and the sec-profile command was already configured for that listen point then all client connections to that listen point will be secure.

If a listen point is specified using the listen-point command, and the default-profile command is not configured, then all client connections to that listen point will not be secure. However, if the default-profile command is later configured, then all now connections to that listen point will be secure using the specified default-profile. This will not affect the non-secure connections.

The following example specifies DOMESTIC as the default profile name for all clients connecting to listen point 10.10.10.1 until the default-profile LAM command is configured. Once the default-profile LAM command is configured, all new client connections will use LAM as the default profile.

tn3270

 security

 profile NOSECURITY none

 default-profile DOMESTIC

pu DIRECT 012ABCDE tok 0 04

 default-profile LAM

listen-point 10.10.10.1

Related Commands

disable (TN3270)

To turn off security in the TN3270 server, use the disable (TN3270) security configuration command.

disable

Syntax Description

This command has no arguments or keywords.

Defaults

No default behavior or values.

Command Modes

Security configuration

Command History

Usage Guidelines

Configuring the disable (TN3270) command does not terminate any active secure or non-secure connections. This command specifies that all new connections established with the TN3270 server will be non-secure. If a client initiates a change cipher specification for an existing secure connection then the TN3270 server will process the request.

There is not a no form for this command. The enable command is equivalent to the no form of this command.

Examples

The following example turns off security in the TN3270 server so that all new connections established with the TN3270 server will be non-secure:

disable

Related Commands

dlur

To enable the Systems Network Architecture (SNA) session switch function on the CMCC adapter and enter dependent logical unit requester (DLUR) configuration mode, use the dlur TN3270 server configuration command. To disable the SNA session switch function and discard all parameter values associated with the SNA session switch, use the no form of this command.

dlur [fq-cpname fq-dlusname]

no dlur

Syntax Description

Defaults

No DLUR function is enabled.

Command Modes

TN3270 server configuration

Command History

Usage Guidelines

This command is valid only on the virtual channel interface. If the SNA session switch function is already enabled, the dlur command with no arguments puts you in DLUR configuration mode. The session switch function implements an End Node DLUR.

Several parameters in the DLUR configuration mode consist of fully qualified names, as defined by the APPN architecture. Fully qualified names consist of two case-insensitive alphanumeric strings, separated by a period. However, for compatibility with existing APPN products, including VTAM, the characters "#" (pound), "@" (at), and "$" (dollar) are allowed in the fully qualified name strings. Each string is from one to 8 characters long; for example, RA12.NODM1PP. The portion of the name before the period is the NET ID and is shared between entities in the same logical network.

The no dlur command hierarchically deletes all resources defined beneath it.

Examples

The following example performs two functions: it enters DLUR configuration mode; and it enables the DLUR function and defines the LU name for the DLUR as SYD.TN3020 and the primary choice for DLUS as SYD.VMG. Note that the NET ID portion of both names is the same:

dlur SYD.TN3020 SYD.VMG

Related Commands

dlus-backup

To specify a backup DLUS for the DLUR function, use the dlus-backup DLUR configuration command. To remove a backup DLUS name, use the no form of this command.

dlus-backup dlusname2

no dlus-backup

Syntax Description

Defaults

No backup DLUS is specified.

Command Modes

DLUR configuration

Command History

Usage Guidelines

This command is valid only on the virtual channel interface. Only one backup DLUS can be specified per CMCC adapter. If the backup DLUS specified in the dlus-backup command is in use when a no dlus-backup command is issued, the connection is not torn down.

Several parameters in the DLUR configuration mode consist of fully qualified names, as defined by the APPN architecture. Fully qualified names consist of two case-insensitive alphanumeric strings, separated by a period. However, for compatibility with existing APPN products, including VTAM, the characters "#" (pound), "@" (at), and "$" (dollar) are allowed in the fully qualified name strings. Each string is from one to 8 characters long; for example, RA12.NODM1PP. The portion of the name before the period is the NET ID and is shared between entities in the same logical network.

Examples

The following example specifies SYD.VMX as the backup DLUS:

dlus-backup SYD.VMX

Related Commands

domain-id

To specify a domain name suffix that the TN3270 server appends to a configured machine name to form a fully qualified name when configuring inverse DNS nailing, use the domain-id TN3270 server configuration command. To disable this specification, use the no form of this command.

domain-id DNS-domain-identifier DNS-domain

no domain-id DNS-domain-identifier DNS-domain

Syntax Description

Defaults

No default behavior or values.

Command Modes

TN3270 server configuration

Command History

Usage Guidelines

The user can configure up to 255 domain names, one per statement.

This command must be configured you configure the client pool command with either the domain-id keyword or the name keyword and the optional DNS-domain-identifier argument.

Examples

In the following example, the domain-id command specifies 23 as the DNS-domain-identifier for the .cisco.com domain name. All clients nailed to the pool GENERAL will use .cisco.com as the domain name suffix. For example, the client name ally-isdn1 will become ally-isdn1.cisco.com.

tn3270-server

 domain-id 23 .cisco.com

  pool GENERAL  cluster layout 4s1p

  listen-point 172.18.5.168

   pu T240CA   91922363 token-adapter 31 12 rmac 4000.4000.0001

    allocate lu 1 pool GENERAL  clusters 1

 client name ally-isdn1 23 pool GENERAL

Related Commands

enable (TN3270)

To turn on security in the TN3270 server, use the enable (TN3270) security configuration mode command.

enable

Syntax Description

This command has no arguments or keywords.

Defaults

No default behavior or values.

Command Modes

Security configuration

Command History

Usage Guidelines

There is not a no form for this command.

If the security command has been disabled, then issuing this command does not affect existing connections.

This command is not displayed in the show running configuration command output because the security functionality is enabled by default.

Examples

The following example turns on security in the TN3270 server:

enable

Related Commands

encryptorder

To specify the security encryption algorithm for the SSL Encryption Support, use the encryptorder profile configuration command.

encryptorder [DES] [3DES] [RC4] [RC2] [RC5]

Syntax Description

Defaults

The default encryption order is RC4, RC2, RC5, DES, 3DES for domestic software. The default encryption order is RC4, RC2, DES for exportable software.

Command Modes

Profile configuration

Command History

Usage Guidelines

There is not a no form for this command.

These algorithms may be entered in any order, but can be specified only once per encryptorder command.

Exportable versions of software cannot accept the 3DES or RC5 encryption algorithms.

Examples

The following example specifies RC4, DES, and RC2 as the encryption algorithms:

tn3270

 security

 profile DOMESTIC SSL

  encryptorder RC4 DES RC2

generic-pool

To specify whether or not leftover LUs will be made available to TN3270 sessions that do not request a specific LU or LU pool through TN3270E, use the generic-pool TN3270 server configuration command. To selectively remove the permit or deny condition of generic pool use, use the no form of this command.

generic-pool {permit | deny}

no generic-pool

Syntax Description

Defaults

In TN3270 server configuration mode, generic pool use is permitted.

In PU configuration mode, the default is the value currently configured in TN3270 server configuration mode.

Command Modes

TN3270 server configuration—The generic-pool command at this level applies to all PUs supported by the TN3270 server.

Listen-point configuration—The generic-pool command at this level applies to all PUs defined at the listen point.

Listen-point PU configuration—The generic-pool command at this level applies only to the specified PU.

DLUR PU configuration—The generic-pool command at this level applies to all PUs defined under DLUR configuration mode.

PU configuration—The generic-pool command at this level applies only to the specified PU.

Command History

Usage Guidelines

This command is valid only on the virtual channel interface.

A leftover LU is defined as one for which all of the following conditions are true:

•The system services control point (SSCP) did not send an ACTLU during PU start-up.

•The PU controlling the LU is capable of carrying product set ID (PSID) vectors on network management vector transport (NMVT) messages, thus allowing dynamic definition of dependent LU (DDDLU) operation for that LU.

All LUs in the generic pool are, by definition, DDDLU capable.

Values entered for generic-pool in TN3270 server configuration mode apply to all PUs for that TN3270 server but can be changed in PU configuration mode.

In PU configuration mode, a no generic-pool command will restore the generic-pool value entered in TN3270 command mode.

In TN3270 server configuration mode, the no generic-pool command reverts to the default, which permits generic pool use.

The command takes effect immediately. If generic-pool deny is specified on a PU, no further dynamic connections to it will be allowed. Existing sessions are unaffected, but as they terminate the LUs will not become available for dynamic connections.

Similarly, if generic-pool permit is specified, any inactive LUs are immediately available for dynamic connections. Moreover, any active LUs that were dynamic previously (before generic-pool deny was issued) return to being dynamic.

Examples

The following example permits generic LU pool use:

generic-pool permit

Related Commands

idle-time

To specify how many seconds of LU inactivity, from both host and client, before the TN3270 session is disconnected, use the idle-time TN3270 server configuration command. To cancel the idle time period and return to the default, use the no form of this command.

idle-time seconds

no idle-time

Syntax Description

Defaults

The default in TN3270 server configuration mode is that the session is never disconnected (0).

The default in PU configuration mode is the value currently configured in TN3270 server configuration mode.

Command Modes

TN3270 server configuration—The idle-time command at this level applies to all PUs supported by the TN3270 server.

Listen-point configuration—The idle-time command at this level applies to all PUs defined at the listen point.

Listen-point PU configuration—The idle-time command at this level applies only to the specified PU.

DLUR PU configuration—The idle-time command at this level applies to all PUs defined under DLUR configuration mode.

PU configuration—The idle-time command at this level applies only to the specified PU.

Command History

Usage Guidelines

The idle-time command is valid only on the virtual channel interface, and can be entered in either TN3270 server configuration mode or PU configuration mode. A value entered in TN3270 mode applies to all PUs for that TN3270 server, except as overridden by values entered in PU configuration mode.

A no idle-time command entered in PU configuration mode will restore the idle-time value entered in TN3270 command mode.

The idle-time command affects currently active and future TN3270 sessions. For example, if the idle-time value is reduced from 900 seconds to 600 seconds, sessions that have been idle for between 600 and 900 seconds are immediately disconnected.

Note For the purposes of idle-time logic, TIMING-MARKs generated by the keepalive logic do not constitute "activity."

Examples

The following command sets an idle-time disconnect value of 10 minutes:

idle-time 600

The following command entered in TN3270 server configuration mode sets the default idle-time disconnect value to 0, or never disconnect:

no idle-time

Related Commands

ip precedence (TN3270)

To specify the precedence level for voice over IP traffic in the TN3270 server, use the ip precedence TN3270 server configuration command. To remove the precedence value, use the no form of this command.

ip precedence {screen | printer} value

no ip precedence {screen | printer}

Syntax Description

Defaults

The default is a precedence value of 0 for both screens and printers.

Command Modes

TN3270 server configuration—The ip precedence (TN3270) command at this level applies to all PUs supported by the TN3270 server.

Listen-point configuration—The ip precedence (TN3270) command at this level applies to all PUs defined at the listen point.

DLUR PU configuration—The ip precedence (TN3270) command at this level applies to all PUs defined under DLUR configuration mode.

PU configuration—The ip precedence (TN3270) command at this level applies only to the specified PU.

Command History

Usage Guidelines

This command is valid only on the virtual channel interface. Precedence values applied in TN3270 PU configuration mode override values applied in TN3270 server configuration mode.

You can enter new or different values for IP precedence without first using the no form of this command.

During initial Telnet negotiations to establish, or bind, the session an IP precedence value of 0 and IP ToS value of 0 is used. These values are used until the bind takes place. When the session is a type 2 bind, the TN3270 client is assumed to be a screen; otherwise the client is assumed to be a printer.

Examples

The following example assigns a precedence value of 3 to printers:

ip precedence printer 3

Related Commands

ip tos

To specify the Type of Service (ToS) level for IP traffic in the TN3270 server, use the ip tos TN3270 server configuration command. To remove the ToS value, use the no form of this command.

ip tos {screen | printer} value

no ip tos {screen | printer}

Syntax Description

Defaults

The default is a ToS value of 0 for both screens and printers.

Command Modes

TN3270 server configuration—The ip tos command at this level applies to all PUs supported by the TN3270 server.

Listen-point configuration—The ip tos command at this level applies to all PUs defined at the listen point.

DLUR PU configuration—The ip tos command at this level applies to all PUs defined under DLUR configuration mode.

PU configuration—The ip tos command at this level applies only to the specified PU.

Command History

Usage Guidelines

This command is valid only on the virtual channel interface. ToS values applied in TN3270 PU configuration mode override values applied in TN3270 server configuration mode.

The default ToS values for screen and printer are 0. However, RFC 1349 recommends different default values. Specifically, the RFC recommends a default minimize screen delay value of 8 and a default maximize printer throughput value of 4. You must configure these values using the ip tos command if you want to comply to the defaults as stated in the RFC.

Table 35 shows the values described in RFC 1349.

.

During initial Telnet negotiations to establish, or bind, the session, an IP precedence value of 0 and IP ToS value of 0 is used. These values are used until the bind takes place. When the session is a type 2 bind, the TN3270 client is assumed to be a screen; otherwise the client is assumed to be a printer.

When you use the no form of the command, the ToS value is either set to 0 for that configuration mode or the value set at a previous (higher) configuration mode is used. For example, if you are at the TN3270 PU configuration mode and issue a no ip tos screen command, any value you configured previously at the TN3270 server configuration mode will take effect.

You can enter new or different values for ToS without first using the no form of this command.

Examples

In the following example, the TN3270 server ToS screen value is set to 10 and a specific PU ToS screen value is set to 0:

interface channel 3/2 
  tn3270-server 
   ip tos screen 8 
   ip tos printer 4 
  pu PUS2 
   ip tos screen 0

Related Commands

keepalive (TN3270)

To specify how many seconds of inactivity elapse before the TN3270 server transmits a DO TIMING-MARK or Telnet no operation (nop) to the TN3270 client, use the keepalive TN3270 server configuration command. To cancel the keepalive period and return to the previously configured siftdown value or the default, use the no form of this command.

keepalive seconds [send {nop | timing-mark [max-response-time]}]

no keepalive

Syntax Description

Defaults

The default behavior is to send timing marks with a keepalive interval of 1800 seconds (30 minutes). If you specify only the keepalive interval, the TN3270 server sends timing-marks.

The default value of the send timing-mark max-response-time command is 30 seconds if the keepalive interval is greater than or equal to 30 seconds. If the value of the keepalive interval is less than 30 seconds, then the default max-response-time is the value of the interval.

Command Modes

TN3270 server configuration—The keepalive command at this level applies to all PUs supported by the TN3270 server.

Listen-point configuration—The keepalive command at this level applies to all PUs defined at the listen point.

Listen-point PU configuration—The keepalive command at this level applies only to the specified PU.

DLUR PU configuration—The keepalive command at this level applies to all PUs defined under DLUR configuration mode.

PU configuration—The keepalive command at this level applies only to the specified PU.

Command History

Usage Guidelines

The keepalive command is valid only on the virtual channel interface. This command can be entered in one of four command modes (TN3270 configuration, Listen-point configuration, Listen-point PU configuration, or PU configuration mode). A value entered in TN3270 mode applies to all PUs for that TN3270 server, except as overridden by values entered in the other supported configuration modes. A no keepalive command entered in a subsequent configuration mode will restore the keepalive value entered in the previous command mode.

In Cisco IOS releases prior to 12.0(5)T in which the keepalive command is supported, you cannot specify the period of time in which the client must respond to the DO TIMING-MARK before the TN3270 server disconnects the session. By default in prior releases, if the client does not reply within 30 minutes of sending the DO TIMING-MARK, the TN3270 server disconnects the TN3270 session. (The DO TIMING-MARK is a Telnet protocol operation that does not affect the client operation.)

With the addition of the send timing-mark max-response-time keywords in Cisco IOS release 12.0(5)T, you can specify the period of time in which the client must respond to the DO TIMING-MARK before being disconnected by the server. If you do not specify the max-response-time argument, the default value is determined by the size of the keepalive interval. The default is 30 seconds if the keepalive interval is greater than or equal to 30 seconds. If the value of the keepalive interval is less than 30 seconds, then the default max-response-time is the value of the interval.

If the IP path to the client is broken, the TCP layer will detect the failure to acknowledge the DO TIMING-MARK and initiate disconnection. This action usually takes much less than 30 seconds.

The keepalive command affects currently active and future TN3270 sessions. For example, reducing the keepalive interval to a smaller nonzero value causes an immediate burst of DO TIMING-MARKs on those sessions that have been inactive for a period of time greater than the new, smaller value.

Use the keepalive send nop command when you are using older TN3270 clients that do not support TIMING-MARK or are DOS-based clients. When you use the keepalive send nop command to monitor the client connection, no response is required by the client to the TN3270 server. However, the TCP/IP stack can detect that the physical connection still exists. This command is useful for those clients that can be swapped out when a DO TIMING-MARK has been sent by the TN3270 server. If the client is swapped out and cannot respond to the DO TIMING-MARK from the TN3270 server, the session is disconnected. However, if the client is swapped out and the Telnet nop command is sent by the server, the physical connection is still verifiable by the TCP/IP stack and the client remains connected to the server.

If your client supports the use of timing-marks and is not subject to being swapped out, then using timing-marks is preferable to the Telnet nop command for keepalive monitoring. The required response by TN3270 clients to timing-marks sent by the server provides a better indication of the health of the client-server connection.

Examples

The following example specifies that the TN3270 server sends a DO TIMING-MARK in 15-minute (900-second) intervals and the client must respond within 30 seconds (the default value for the timing-mark max-response-time command when not specified):

keepalive 900

The following example entered in TN3270 server configuration mode specifies that the TN3270 server sends a DO TIMING-MARK in 30-minute (1800-second) intervals (the default interval) and the client must respond within 30 seconds (the default for the timing-mark max-response-time command when not specified):

no keepalive

The following example specifies that the TN3270 server sends a DO TIMING-MARK in 40-minute (2400-second) intervals and the client must respond within 1 minute (60 seconds):

keepalive 2400 send timing-mark 60

Consider the following example in which the keepalive command is configured in more than one command mode. In this example the keepalive command is first configured in TN3270 server configuration mode, followed by Listen-point PU configuration mode. The keepalive command values specified under the listen-point PU overrides the keepalive 300 value specified under the tn3270-server for PU1. In this example, all other PUs except PU1 use the value of the keepalive 300 command specified in TN3270 server configuration mode.

tn3270-server

keepalive 300

listen-point 10.10.10.1 tcp-port 40

  pu PU1 94223456 tok 1 08

    keepalive 10 send timing-mark 5

  pu PU2 94223457 tok 2 12

Related Commands

keylen

To specify the maximum bit length for the encryption keys for SSL Encryption Support, use the keylen 128 profile configuration command. To disable this specification and thereby set the key length to the default of 40 bits, use the no form of this command or keylen 40.

keylen {40 | 128}

no keylen [40 | 128]

Syntax Description

Defaults

The default encryption key length is 40 bits.

Command Modes

Profile configuration.

Command History

Usage Guidelines

Exportable software versions cannot accept encryption key lengths greater than 40 bits.

The length is optional on the no form of this command. Entering the no form of this command with no length resets the length to the default value of 40 bits.

If the key length is changed, all new connections will use the new value. If an active session renegotiates its security specifications, it will use the new key length value.

Examples

The following example specifies the maximum encryption key length value to 128 bits:

tn3270-server

 security

 profile DOMESTIC SSL

  encryptorder RC4 DES RC2

  keylen 128

link (TN3270)

To define and activate a link to a host, use the link DLUR SAP configuration command. To delete the link definition, use the no form of this command.

link name [rmac rmac] [rsap rsap]

no link name

Syntax Description

Defaults

No DLUR link is defined.

The default remote SAP address is 04 (hexadecimal).

Command Modes

DLUR SAP configuration

Command History

Usage Guidelines

This command is valid only on the virtual channel interface. The combination of rmac and rsap must be unique within the DLUR SAP function. These values can only be changed by deleting the link definition, using the no link command, and recreating the link definition.

For a link via a channel on this CMCC adapter, the TN3270 server and the hosts should open different adapters. Using different adapters avoids any contention for SAP numbers, and is also necessary if you configure duplicate MAC addresses for fallback CSNA or CMPC access to the host.

Examples

The following example defines a link name and a remote SAP address:

link LINK5 rsap 08

The following example shows different adapter numbers configured on the same internal LAN to avoid SAP contention. The host uses SAP 4 on Token Ring adapter 0.

lan tokenring 0

 adapter 0 4000.0000.0001

 adapter 1 4000.0000.0002

tn3270-server

 dlur ...

 lsap token-adapter 1

  link HOST rmac 4000.0000.0001 rsap 4

Related Commands

listen-point

To define an IP address for the TN3270 server, use the listen-point TN3270 server configuration command. To remove a listen point for the TN3270 server, use the no form of this command.

listen-point ip-address [tcp-port number]

no listen-point ip-address [tcp-port number]

Syntax Description

Defaults

The default tcp-port number is 23.

Command Modes

TN3270 server configuration

Command History

Usage Guidelines

Use the listen-point command to create a unique listen point for every IP address and TCP-port pair. In this mode, the IP address and the TCP port are no longer configured in the PU. Configure the PUs under the appropriate listen point. The other siftdown configuration commands remain the same.

For example, in the old configuration the following statements were used to configure the IP address and TCP port in the PU:

tn3270-server

  pu PU1 94223456 10.10.10.1 tok 1 08

   tcp-port 40

   keepalive 10

In the new listen-point configuration, the following statements are used to configure the IP address and TCP port at the listen point:

tn3270-server

  listen-point 10.10.10.1 tcp-port 40

   pu PU1 94223456 tok 1 08

    keepalive 10

You can also use the listen-point configuration to assign the same IP address to multiple PUs. In the old configuration the following statements were used:

tn3270-server

  pu PU1 94201231 10.10.10.2 tok 1 10

  pu PU2 94201232 10.10.10.3 tok 1 12

  pu PU3 94201234 10.10.10.3 tok 1 14

  pu PU4 94201235 10.10.10.4 tok 1 16

   tcp-port 40

  pu PU5 94201236 10.10.10.4 tok 2 08

In the new listen point configuration, the old statements are replaced by the following configuration commands. In this example, PU2 and PU3 are grouped into one listen point because they have the same IP address. Note that even though PU4's IP address is identical to PU5's IP address, they are not configured within the same listen point because the listen point indicates a unique IP address and TCP port pair. If you do not specify the TCP port, the default port value is 23.

tn3270-server

 listen-point 10.10.10.2

  pu PU1 94201231 tok 1 10

 listen-point 10.10.10.3

  pu PU2 94201232 tok 1 12

  pu PU3 94201234 tok 1 14

 listen-point 10.10.10.4

  pu PU5 94201236 tok 2 08

 listen-point 10.10.10.4 tcp-port 40

  pu PU4 94201235 tok 1 16

The next example shows how the configuration changes for a DLUR PU. In this mode, the DLUR PU is no longer configured under DLUR, but is configured in the listen point.

In the old configuration, the following statements were used:

tn3270-server

 dlur NETA.RTR1 NETA.HOST

  dlus-backup NETA.HOST

  lsap token-adapter 15 08

   link MVS2TN rmac 4000.b0ca.0016

  pu PU1 017ABCDE 10.10.10.6

These statements are replaced by the following statements in the new listen-point configuration. The keyword dlur differentiates the listen-point direct PU from the listen point DLUR PU. The DLUR configuration must be completed before configuring the PU in the listen point. Any siftdown commands configured within the scope of the listen point are automatically inherited by the PUs that are configured within the scope of that listen point. To override the siftdown configurations, you can explicitly configure the siftdown configuration commands within the scope of the listen-point PU.

tn3270-server

 dlur NETA.RTR1 NETA.HOST

  dlus-backup NETA.HOST

  lsap token-adapter 15 08

   link MVS2TN rmac 4000.b0ca.0016

 listen-point 10.10.10.6

  pu PU1 017ABCDE dlur

Examples

Following is an example of the listen-point command showing PU7 grouped into the listen point at IP address 10.10.10.1 and TCP port 40:

tn3270-server

listen-point 10.10.10.1 tcp-port 40

 pu PU7 94201237 tok 1 17

Related Commands

lsap

To create a SAP in the SNA session switch and enter DLUR SAP configuration mode, use the lsap DLUR configuration command. To delete a SAP and all SNA session switch links using the internal LAN interface, use the no form of this command.

lsap type adapter-number [lsap]

no lsap type adapter-number [lsap]

Syntax Description

Defaults

The default value for the lsap argument is hexadecimal C0.

Command Modes

DLUR configuration

Command History

Usage Guidelines

The lsap command is valid only on the virtual channel interface. If the SAP in the SNA session switch function is already created, the lsap command with no arguments puts you in DLUR SAP configuration mode.

The lsap command can be entered only in DLUR configuration mode.

The lsap command uses values that are defined in two other commands: the lan internal LAN configuration command and the adapter internal LAN configuration command. The lan type and adapter adapter-number values configured on the CMCC internal LAN interface are used in the lsap command. However, the lan type keyword is a little different. Where the value for the type argument on the lan command is tokenring, the corresponding value for the type argument on lsap is token-adapter. This emphasizes that the number that follows is an adapter number, not a lan number.

The no lsap command hierarchically deletes any links using it. Any sessions using those links are lost.

Examples

The following example defines an adapter type, an adapter number, and a local SAP:

lsap token 0 B0

Related Commands

lu deletion

To specify whether the TN3270 server sends a REPLY-PSID poweroff request to VTAM to delete the corresponding LU when a client disconnects, use the lu deletion TN3270 server configuration command. To remove LU deletion from the current configuration scope, use the no form of this command.

lu deletion {always | normal | non-generic | never | named}

no lu deletion

Syntax Description

Defaults

The default keyword is never.

Command Modes

TN3270 server configuration—The lu deletion command at this level applies to all PUs supported by the TN3270 server.

Listen-point configuration—The lu deletion command at this level applies to all PUs defined at the listen point.

Listen-point PU configuration—The lu deletion command at this level applies only to the specified PU.

DLUR PU configuration—The lu deletion command at this level applies to all PUs defined under DLUR configuration mode.

PU configuration—The lu deletion command at this level applies only to the specified PU.

Note The lu deletion command is a siftdown command, so it can be used at any of the configuration command modes shown. The most recent lu deletion command in the PU configuration takes precedence.

Command History

Usage Guidelines

Use the always keyword of the lu deletion command when you have only screen LUs, and they are all different sizes. This prevents screen LUs from attaching to a previously used LU with an incompatible screen size.

Use the normal keyword of the lu deletion command when you have both screen and printer LUs. This is important because printers are acquired by the host application, and not logged on manually. If VTAM deletes the LU, then there is nothing for a host application (such as CICS) to acquire.

You can use the non-generic mode of LU deletion if VTAM can support deletion of specifically-named LUs. (The support of this mode is not currently available in VTAM, as of VTAM version 4.4.1.)

Use the never mode of LU deletion when you have only screen LUs and they all use the same screen size.

Use the named keyword of the lu deletion command when you have configured dynamic LU names from the TN3270 server side.

Examples

Following is an example of the lu deletion command specifying that the TN3270 server send a REPLY-PSID poweroff request to delete only screen LUs upon session disconnect for any PUs supported by the TN3270 server:

tn3270-server

 lu deletion normal

Following is an example of the lu deletion command configuring a listen-point PU to define DLUR PUs using dynamic LU naming:

tn3270-server

listen-point 172.18.4.18

pu pu1 05D9901 dlur 

 lu deletion named

Related Commands

lu termination

To specify whether a TERMSELF or UNBIND RU is sent by the TN3270 server when a client turns off his device or disconnects, use the lu termination TN3270 server configuration command. To remove LU termination from the current configuration scope, use the no form of this command.

lu termination {termself | unbind}

no lu termination

Syntax Description

Defaults

Unbind is the default.

Command Modes

TN3270 server configuration—The lu termination command at this level applies to all PUs supported by the TN3270 server.

Listen-point configuration—The lu termination command at this level applies to all PUs defined at the listen point.

Listen-point PU configuration—The lu termination command at this level applies only to the specified PU.

DLUR PU configuration—The lu termination command at this level applies to all PUs defined under DLUR configuration mode.

PU configuration—The lu termination command at this level applies only to the specified PU.

Note The lu termination command is a siftdown command, so it can be used at any of the configuration command modes shown. The most recent lu termination command in the PU configuration takes precedence.

Command History

Usage Guidelines

Use the termself keyword when you want to be sure that the application terminates the session when the LU disconnects. This is important for certain applications such as CICS.

If you use the unbind keyword for session termination with applications such as CICS, VTAM security problems can arise. When CICS terminates a session from an UNBIND request, the application may reestablish a previous user's session with a new user, who is now assigned to the same freed LU.

Examples

Following is an example of the lu termination configuration command to force termination of the session when an LU disconnects for any PUs supported by the TN3270 server:

tn3270-server

 lu termination termself

maximum-lus

To limit the number of LU control blocks that will be allocated for the TN3270 server, use the maximum-lus TN3270 server configuration command. To restore the default value, use the no form of this command.

maximum-lus number

no maximum-lus

Syntax Description

Defaults

Because of the license structure, the default is 2100, which represents the limit of the lower-priced license (2000) plus a five percent buffer. If you configure a value greater than the default, a license reminder is displayed.

Command Modes

TN3270 server configuration

Command History

Usage Guidelines

The maximum-lus command is valid only on the virtual channel interface. Although the value may be varied at any time, reducing it below the current number of LU control blocks will not release those blocks until a PU is inactivated by DACTPU or by using the no pu command.

If the number of LUs in use reaches 94 percent of the current setting of maximum-lus, a warning message is displayed on the console. To prevent redundant messages, the threshold for generating such messages is raised for a period.

The TN3270 server attempts to allocate one LU control block for each LU activated by the hosts. In the case of dynamic definition of dependent LU (DDDLU) the control block is allocated when the client requests the LU, in anticipation of an ACTLU from the SSCP host.

By limiting the number of LU control blocks allocated, you can make sure enough memory is available to support other CMCC functions. The control blocks themselves take about 1K bytes per LU. During session activity, a further 2K per LU may be needed for data. On a CIP, 32 MB of memory will support 4000 LUs. To support more than 4000 LUs, we recommend 64 MB of memory. On an XCPA, 8 MB of memory supports 1000 LUs.

Examples

The following example allows 5000 LU control blocks to be allocated:

maximum-lus 5000

Related Commands

pool

To define pool names for the TN3270 server and specify the number of screens and printers in each logical cluster, use the pool TN3270 server configuration command. To remove a client IP pool, use the no form of this command.

pool poolname [cluster layout layout-spec-string]

no pool poolname

Syntax Description

Defaults

The default value for the layout-spec-string argument is "1a."

Command Modes

TN3270 server configuration

Command History

Usage Guidelines

The pool and allocate lu commands enable the TN3270 server to know the relationships between screen and printer LUs. These commands are an alternative to the LU nailing feature that allows clients to be nailed to LUs.

The pool command is configured in the TN3270 scope. The pool command provides the pool names and the definitions of the number of screens and printers in one logical cluster. Each pool statement must have a unique pool name.

The TN3270 server validates pool names when configuring a pool name and when processing the name received on a CONNECT request from the client. The TN3270 server rejects an invalid name and truncates the name received in the CONNECT request from the client to 8 characters or at an invalid character (whichever comes first) when processing the CONNECT request.

When using a pool command to create a cluster, a combination of the following values is used in the layout-spec-string:

•s (screen)

•p (printer)

•a (any, or wildcard) [Refers to a printer or a screen]

Use the following format to define the layout-spec-string, where decimal_num is a decimal number between 1 and 255:

pool poolname cluster layout {decimal_nums}{decimal_nump}{decimal_numa}

The total sum of the numbers must be less than or equal to 255. No spaces are used between the entries in the layout-spec-string. The default is 1a, which defines 1 screen or 1 printer. A screen, printer, or a wildcard definition cannot be followed by a definition of the same type. A screen definition can only be followed by a printer or wildcard. Similarly, a printer definition can be followed only by a wildcard or a screen definition.

The following are examples of invalid layout-spec-string values, and the corresponding corrected specification:

•A layout-spec-string of 3s6s is invalid. The correct specification is 9s.

•A layout-spec-string of 3s6p7a8a is invalid. The correct specification is 3s6p15a.

•A layout-spec-string of 255s10p is invalid. Although the decimal number for any portion of the layout-spec-string can be between 1 and 255, the total number across all parameters cannot exceed 255. To correct this example, you can reduce the screens to 245 as 245s10p.

The combination of a screen, printer, and wildcard constitute a group. The layout-spec-string can support a maximum of 4 groups.

Consider the following example:

pool CISCO cluster layout 2s3p4a5s6a7s8p9s

There are 4 groups in this definition: 2s3p4a, 5s6a, 7s8p and 9s.

Pools must be defined before any pool references under the listen points are defined. Also, pools must be defined before they are referenced by other statements in the configuration. Failure to define the pool before it is referenced will cause the referencing configuration to be rejected.

Pools that are deleted (using the no form of the command) will cause all statements referencing the pool to be deleted.

The following criteria apply to the creation of pool names and LOCADDRs:

•Pool and LU names must be unique; they cannot be identical.

•LOCADDR ranges for pools must not overlap.

•LOCADDR ranges for LU pools must not overlap with the existing client nailing configuration.

•Pool configurations made while LUs are in use do not affect the current LU configuration.

The following example uses the pool command to create two pools, pcpool and unixpool:

tn3270-server

 pool pcpool cluster layout 4s1p

 pool unixpool cluster layout 49s1p

listen-point 10.20.30.40

 client ip 10.10.10.2 pool pcpool

 pu PU1 91903315 dlur

  allocate lu 1 pool pcpool clusters 50

 pu PU2 91903345 dlur

  allocate lu 1 pool unixpool clusters 5

In this example, the pcpool contains a cluster of 4 screens and 1 printer per cluster. The total number of devices in a cluster cannot exceed 255, therefore the pcpool contains a total of 50 clusters with each cluster containing 5 LUs. Note that the remaining 5 LUs automatically go to the generic pool.

The unixpool contains 49 screens and 1 printer per cluster. The total number of devices in a cluster cannot exceed 255, therefore the unixpool contains a total of 5 clusters with each cluster containing 50 LUs. Again, note that the last 5 LUs automatically go to the generic pool.

Related Commands

preferred-nnserver

To specify a preferred network node (NN) as server, use the preferred-nnserver DLUR configuration command. To remove the preference, use the no form of this command.

preferred-nnserver name

no preferred-nnserver

Syntax Description

Defaults

No default behavior or values.

Command Modes

DLUR configuration

Command History

Usage Guidelines

The preferred-nnserver command is valid only on the virtual channel interface. Fully qualified names consist of two case-insensitive alphanumeric strings, separated by a period. However, for compatibility with existing APPN products, including VTAM, the characters "#" (pound), "@" (at), and "$" (dollar) are allowed in the fully qualified name strings. Each string is from one to 8 characters long; for example, RA12.NODM1PP. The portion of the name before the period is the NET ID and is shared between entities in the same logical network.

When no preferred server is specified, the DLUR will request NN server support from the first suitable node with which it makes contact. If refused, it will try the next one, and so on.

If a preferred server is specified, then DLUR will wait a short time to allow a link to the preferred server to materialize. If the preferred server is not found in that time, any suitable node can be used, as above.

DLUR will not relinquish the current NN server merely because the preferred server becomes available.

Examples

The following example selects SYD.VMX as the preferred NN server:

preferred-nnserver SYD.VMX

Related Commands

profile

To specify a name and a security protocol for a security profile and enter profile configuration mode, use the profile security configuration command. To remove this name and protocol specification, use the no form of this command.

Create a new profile:

profile profilename {ssl | none}

Modify an existing profile:

profile profilename

Delete a profile:

no profile profilename {ssl | none}

Syntax Description

Defaults

No default behavior or values.

Command Modes

Security configuration

Command History

Usage Guidelines

This command creates or modifies a security profile. To create a profile, specify the name of the new profile along with the security type. To modify a security profile, specify the name of the profile without the security type. The security type is only required when creating a profile. Using the security type when modifying a profile will result in an error.

Profile names cannot be duplicated.

Entering the no form of this command deletes the profile definition and all of its subcommand definitions (encryptorder, servercert, keylen, certificate reload commands). Entering the no form of this command deletes the sec-profile command specifications on all listen points where it is currently defined.

Entering the profile command moves the user into the profile configuration mode. Entering the no form of the command moves the user into the security configuration mode.

This command has no retroactive effect.

Examples

The following example specifies LAM as the profile name and ssl as the security protocol. When the no profile LAM command is configured, all new client connections will be non-secure.

tn3270-server

 security

 profile LAM ssl

  keylen 40

  servercert slot0:lam

  certificate reload

listen-point 10.10.10.1 

 sec-profile LAM

 pu DIRECT 012ABCDE tok 0 04

 no profile LAM

Related Commands

pu (DLUR)

To create a PU entity that has no direct link to a host or to enter PU configuration mode, use the pu DLUR configuration command. To remove the PU entity, use the no form of this command.

pu pu-name idblk-idnum ip-address

no pu pu-name

Syntax Description

Defaults

No PU is defined.

Command Modes

DLUR configuration

Command History

Usage Guidelines

If the PU is already created, the pu pu-name command with no arguments puts you in PU configuration mode. In this mode you can modify an existing PU DLUR entity.

A typical usage for the IP address is to reserve an IP address per host application. For example, clients wanting to connect to TSO specify an IP address that will be defined with PUs that have LOGAPPL=TSO.

Examples

The following example defines define three PUs. Two of the PUs share the same IP address and the third PU has a separate IP address:

pu p0  05D99001 192.195.80.40

pu p1  05D99002 192.195.80.40

pu p2  05D99003 192.195.80.41

Related Commands

pu (listen-point)

To create a PU entity that has a direct link to a host or to enter listen-point PU configuration mode, use the pu listen-point configuration command. To remove the PU entity, use the no form of this command.

pu pu-name idblk-idnum type adapter-number lsap [rmac rmac] [rsap rsap] [lu-seed lu-name-stem]

no pu pu-name

Syntax Description

Defaults

The default remote SAP address is 04 (hexadecimal).

Command Modes

Listen-point configuration

Command History

Usage Guidelines

The pu pu-name command is valid only on the virtual channel interface. If the PU is already created, the pu pu-name command with no arguments puts you in listen-point PU configuration mode, where you can modify an existing PU entity.

The pu listen-point command uses values that are defined in two other commands: the lan internal LAN configuration command and the adapter internal LAN configuration command. The lan type and adapter adapter-number values configured on the CIP internal LAN interface are used in the pu command.

For a link via a channel on this CMCC adapter, the TN3270 server and the hosts should open different adapters. Using different adapters avoids contention for SAP numbers and is also necessary if you configure duplicate MAC addresses for fallback CSNA or CMPC access to the host.

Examples

The following example configures the TN3270 server to be active and has one PU, CAPPU1, trying to connect. An LU seed using hexadecimal digits is defined.

tn3270-server

pu CAPPU1 05D18101 token-adapter 3 04 rmac 4000.0501.0001 lu-seed CAP01L##

The following example shows different adapter numbers configured on the same internal LAN to avoid SAP contention. The host uses SAP 4 on Token Ring adapter 0.

lan tokenring 0

 adapter 0 4000.0000.0001

 adapter 1 4000.0000.0002

tn3270-server

 listen-point 10.20.30.40

  pu PU1 05d00001 token-adapter 1 8 rmac 4000.0000.0001 rsap 4

Related Commands

pu (TN3270)

To create a PU entity that has its own direct link to a host and enter PU configuration mode, use the pu TN3270 server configuration command. To remove the PU entity, use the no form of this command.

pu pu-name idblk-idnum ip-address type adapter-number lsap [rmac rmac] [rsap rsap] [lu-seed lu-name-stem]

no pu pu-name

Syntax Description

Defaults

No PU is defined.

The default remote SAP address is 04 (hexadecimal).

Command Modes

TN3270 server configuration

Command History

Usage Guidelines

The pu pu-name command is valid only on the virtual channel interface. If the PU is already created, the pu pu-name command with no arguments puts you in PU configuration mode, where you can modify an existing PU entity.

The pu (TN3270) command uses values that are defined in two other commands: the lan internal LAN configuration command and the adapter internal LAN configuration command. The lan type and adapter adapter-number values configured on the CIP internal LAN interface are used in the pu command.

For a link via a channel on this CMCC adapter, the TN3270 server and the hosts should open different adapters. Using different adapters avoids any contention for SAP numbers, and is also necessary if you configure duplicate MAC addresses for fallback CSNA or CMPC access to the host.

Examples

The following example configures the TN3270 server to be active, and has one PU, CAPPU1, trying to connect in. An LU seed using hexadecimal digits is defined.

tn3270-server

pu CAPPU1 05D18101 10.14.20.34 token-adapter 3 rmac 4000.0501.0001 lu-seed CAP01L##

The following example shows different adapter numbers configured on the same internal LAN to avoid SAP contention. The host uses SAP 4 on token ring adapter 0.

lan tokenring 0

 adapter 0 4000.0000.0001

 adapter 1 4000.0000.0002

tn3270-server

 pu PU1 05d00001 10.0.0.1 token-adapter 1 8 rmac 4000.0000.0001 rsap 4

Related Commands

pu dlur (listen-point)

To create a PU entity that has no direct link to a host or to enter listen-point PU configuration mode, use the pu dlur listen-point configuration command. To remove the PU entity, use the no form of this command.

pu pu-name idblk-idnum dlur [lu-seed lu-name-stem]

no pu pu-name idblk-idnum dlur [lu-seed lu-name-stem]

Syntax Description

Defaults

No PU is defined.

Command Modes

Listen-point configuration

Command History

Usage Guidelines

If the PU is already created, the pu dlur command without any arguments starts listen-point PU configuration mode. In this mode you can modify an existing listen-point DLUR PU entity.

You should define the DLUR before you configure the listen-point DLUR PU.

A typical usage for the IP address is to reserve an IP address for each application. For example, clients wanting to connect to TSO specify an IP address that is defined with PUs that have LOGAPPL=TSO.

If the lu-seed option is not configured, the PU name is used as the implicit lu-seed to generate the LU name. If the lu-seed option is configured, then there is an explicit LU name.

If the explicit LU names conflict, the TN3270 server will reject the PU configuration. If the implicit LU names (i.e., the PU names) conflict, the TN3270 server will accept the PU definitions, but the LU names will consist of a modified, truncated version of the PU name and the LOCADDR.

Examples

The following example defines three PUs in the listen point with an IP address of 172.18.4.18:

tn3270-server

listen-point 172.18.4.18

 pu p0  05D99001 dlur

 pu p1  05D99002 dlur

 pu p2  05D99003 dlur

The following is an example of the TN3270 server configured with LU pooling. A listen-point PU is configured to define DLUR PUs using the dynamic LU naming. Note that the lu deletion command must be configured with the named option. The PU pu1 is defined with lu-seed abc##pqr. Using hexadecimal numbers for ##, the LU names for this PU are ABC01PQR, ABC02PQR, ABC0APQR.... up to ABCFFPQR. Similarly, the PU pu2 is defined with lu-seed pqr###. Using decimal numbers for ###, the LU names for this PU are PQR001, PQR002... up to PQR255.

The LUs ABC01PQR through ABC32PQR and PQR100 through PQR199 are allocated to the pool SIMPLE. The LUs ABC64PQR through ABC96PQR and PQR010 through PQR035 are allocated to the pool PCPOOL. The remaining LUs are in the generic pool.

tn3270-server

 pool simple cluster layout 1s

 pool pcpool cluster layout 4s1p

 lu deletion named

 dlur neta.shek neta.mvsd

  lsap tok 15 04

    link she1 rmac 4000.b0ca.0016

 listen-point 172.18.4.18

 pu pu1 91903315 tok 16 08 lu-seed abc##pqr

   allocate lu 1 pool simple clusters 50

   allocate lu 100 pool pcpool clusters 10

 pu pu2 91913315 dlur lu-seed pqr###

   allocate lu 10 pool pcpool clusters 5

   allocate lu 100 pool simple clusters 100

Related Commands

response-time group

To configure a client subnet group for response-time measurements, use the response-time group TN3270 server configuration command. To remove a client subnet group from response-time measurements, use the no form of this command.

response-time group name [bucket boundaries t1 t2 t3 t4...] [multiplier m]

no response-time group name

Syntax Description

Defaults

Bucket boundaries and the multiplier value are fixed to the following defaults:

•Bucket boundaries—10, 20, 50, 100

•Multiplier—30

Command Modes

TN3270 server configuration

Command History

Usage Guidelines

Multiple response-time groups can be configured within the scope of available memory. When using this command, up to 1024 IP subnets can be defined per response-time group with the client ip command. All TN3270 clients belonging to subnets configured within a specific response-time group are added to the response-time group when they connect as clients.

If the IP address and mask combination already exists within any response-time group, the following error message is displayed:

Subnet 10.1.1.0 255.255.255.248 already exists in client group MYSUBNET 

In the following example, the response-time group MYSUBNET is configured:

tn3270-server

response-time group MYSUBNET bucket boundaries 15 25 60 120 multiplier 35

 client ip 10.1.1.0 255.255.255.248

 client ip 10.1.2.0 255.255.255.248

Related Commands

sec-profile

To specify a security profile to be associated with a listen point, use the sec-profile listen-point configuration command. To remove this specification, use the no form of this command.

sec-profile profilename

no sec-profile profilename

Syntax Description

Defaults

No default behavior or values.

Command Modes

TN3270 listen-point configuration

Command History

Usage Guidelines

If this command is not entered or if the no form of the command is entered, the security profile reverts to the profile configured in the default-profile command. If no default profile is specified, the listen point accepts only nonsecure connections

This command has no retroactive effect.

Examples

The following example specifies LAM as the security profile name for all new clients connecting to listen point 10.10.10.1 until the sec-profile LAM1 command is configured. Once the sec-profile LAM1 command is configured, all new client connections to 10.10.10.1 will use LAM1 as the profile name.

tn3270-server

 security

 profile LAM ssl

  keylen 128

  servercert slot0:lam

  certificate reload

 profile LAM1 ssl

  keylen 40

  servercert slot0:lam1

  certificate reload

 listen-point 10.10.10.1 

 sec-profile LAM

 pu DIRECT 012ABCDE tok 0 04

Sec-profile LAM1

Related Commands

security (TN3270)

To enable security on the TN3270 server, use the security command. To turn off security on the TN3270 server, use the no form of this command.

security

no security

Syntax Description

This command has no arguments or keywords.

Defaults

The default is to have security enabled.

Command Modes

TN3270 server configuration

Command History

Usage Guidelines

If the no form of this command is configured, any listen points that contain a security profile definition are reconfigured and are no longer secure. Sessions already established on the listen point will continue to run in the same mode (secure or non-secure) as originally configured. If sessions are active on a listen point, a message will be sent to the console stating that the listen point has sessions running with an outdated security specification. A shutdown/restart sequence must be performed on the listen point if the user wants the sessions on the listen point to use the new specification.

Entering the security command moves the user into the security configuration mode. Entering the no form of this command moves the user to a TN3270 server configuration mode.

This command has no retroactive effect.

Examples

In the following example, security is enabled on the TN3270 server:

tn3270-server

 security

servercert

To specify the location of the TN3270 server's security certificate in the router's Flash memory, use the servercert profile configuration command.

servercert location

Syntax Description

Defaults

No default behavior or values.

Command Modes

Profile configuration

Command History

Usage Guidelines

The certificate is in X.509 format, signed by a Certificate Authority (CA). The certificate must be created offline. It cannot be created using using the Cisco IOS software. Use third-party software or a Windows-based utility. The certificate should be in PEM or Base 64 format. The output from the certificate generation contains two parts: the certificate and the private key. Concatenate these two files to create a single certificate file in PEM or Base 64 format.

Store the concatenated file in Flash memory using TFIP and the location entered using the servercert location command. If the file does not exist in the Flash memory when the command is entered, an error message is displayed indicating that the file does not exist. The first time this command is configured the certificate is automatically loaded from the specified location. Subsequent changes to the location file do not cause the certificate to be read automatically into system's memory. The certificate reload command must be entered to read the certificate into memory. If the user exits from the profile configuration mode without configuring the servercert command, a warning message is displayed. The warning message indicates that it is mandatory to configure a certificate using the servercert command.

The following example specifies that slot0:lam is the location of the security certificate:

tn3270-server

 security

 profile LAM ssl

  keylen 512

  servercert slot0:lam

  certificate reload

Related Commands

show extended channel tn3270-server

To display current server configuration parameters and the status of the PUs defined for the TN3270 server, use the show extended channel tn3270-server EXEC command.

show extended channel slot/port tn3270-server

Syntax Description

Defaults

No default behavior or values.

Command Modes

EXEC

Command History

Examples

The following is sample output from the show extended channel tn3270-server command:

Router# show extended channel 3/2 tn3270-server

<current stats> < connection stats >  <response time(ms)>

server-ip:tcp        lu in-use   connect disconn fail   host     tcp

172.28.1.106:23     510     1       12       11     0     54     40

172.28.1.107:23     511     0        0        0     0      0      0

172.28.1.108:23     255     0        0        0     0      0      0

total              1276     1

configured max_lu 20000  unbind-action disconnect

idle-time 0  keepalive 1800 (send nop)

tcp-port 23  generic-pool permit no timing-mark

lu-termination unbind lu-deletion never

dlur MPX.GOANCP                              status SHUT    

dlus MPX.NGMVMPC 

name(index)    ip:tcp               xid   state     link   destination   r-lsap

EXT2(1)      172.28.1.106:23     05D18092 ACTIVE    tok 0  4000.7470.00e7 08 04

PUS10(2)     172.28.1.107:23     05D19010 ACTIVE    tok 0  4000.7470.00e7 08 2C

PUS11(3)     172.28.1.107:23     05D19011 ACTIVE    tok 0  4000.7470.00e7 08 28

PUS12(4)     172.28.1.108:23     05D19012 ACTIVE    tok 0  4000.7470.00e7 08 24

PUS9(5)      172.28.1.109:23     05D18509 SHUT      tok 0  4001.3745.1088 04 40

SDTF(7)      172.28.1.107:23     12345678 ACTIVE    tok 0  0800.5a4b.1cbc 04 08

TEST(8)      172.28.1.106:23     05D18091 ACTIVE    tok 0  4000.7470.00e7 08 30

INT1(6)      172.28.1.106:23     05D18091 SHUT      dlur

Table 37 describes significant fields in the display. Those fields not described correspond to configured values.

show extended channel tn3270-server client-ip-address

To display information about all clients at a specific IP address, use the show extended channel tn3270-server client-ip-address EXEC command.

show extended channel slot/port tn3270-server client-ip-address ip-address [disconnected | in-session | pending]

Syntax Description

Command Modes

EXEC

Command History

Usage Guidelines

The show extended channel tn3270-server client-ip-address command is valid only on the virtual channel interface. Note that this command does not show information about LUs that have never been connected.

Examples

The following is sample output from the show extended channel tn3270-server client-ip-address command. The example shows only active sessions because no other session types exist at this client IP address.

Router# show extended channel 3/2 tn3270-server client-ip 192.195.80.40

lu    name   client-ip:tcp        nail state    model   frames in out   idle for

1   PUS11001 192.195.80.40:3169    Y   ACT/SESS 327804   5       5       0:5:47

pu is PUS11, lu is DYNAMIC type 2, negotiated TN3270

bytes 155 in, 1758 out; RuSize 1024 in, 3840 out; NegRsp 0 in, 0 out

pacing window 0 in, 1 out; credits 0 in, queue-size 0 in, 0 out

The following is sample output using the disconnected keyword:

Router# show extended channel 2/2 tn3270 client-ip 10.14.1.21 disconnected

Total 2 clients found using 10.14.1.21

The following is sample output using the in-session keyword:

Router# show extended channel 2/2 tn3270 client-ip 10.14.1.21 in-session

Note: if state is ACT/NA then the client is disconnected

lu    name   client-ip:tcp       nail state    model   frames in out   idle for

3    PU1L03 10.14.1.21:35215      N   ACT/SESS 327804    317     316     0:0:1

pu is PU1, lu is DYNAMIC type 2, negotiated TN3270

bytes 12167 in, 225476 out; RuSize 2048 in, 1536 out; NegRsp 0 in, 0 out

pacing window 0 in, 1 out; credits 0 in, queue-size 0 in, 0 out

Note: if state is ACT/NA then the client is disconnected

lu    name   client-ip:tcp       nail state    model   frames in out   idle for

4    PU1L04 10.14.1.21:35216      N   ACT/SESS 327804   317     316     0:0:1

pu is PU1, lu is DYNAMIC type 2, negotiated TN3270

bytes 12167 in, 225476 out; RuSize 2048 in, 1536 out; NegRsp 0 in, 0 out

pacing window 0 in, 1 out; credits 0 in, queue-size 0 in, 0 out

Note: if state is ACT/NA then the client is disconnected

Total 2 clients found using 10.14.1.21

The following is sample output using the pending keyword:

Router# show extended channel 2/2 tn3270 client-ip 10.14.1.21 pending

Total 2 clients found using 10.14.1.21

Table 38 describes significant fields in the display.

Related Commands

show extended channel tn3270-server client-name

To display information about all connected clients with a specific machine name, use the show extended channel tn3270-server client-name EXEC command.

show extended channel slot/virtual channel tn3270-server client-name name

Syntax Description

Defaults

No default behavior or values.

Command Modes

EXEC

Command History