Access our production system thru a 170 system with an integrated firewall. All of our users are set up in the shop. Auto create of virtual devices is turned off so that only those systems defined are allowed in.

Next, we give all users the same user name and password to the initial system. When the signon is correct, it passes them thru to the production system. It takes 2-3 passwords to make this happen, but it works great for us.

We don't have critical information on our site like credit card numbers, etc. because of the type of business we are. This would affect your decision, of course.

The biggest security hole on the 400 is allowing ANYTHING to be automatically created. Keep the device descriptions in house.

---

Yes, there is a firewall. According to IBM, they do not support this, but they told me it should work. I opened up ports 23,449,8470,8471,8472,8473,8474,8475,8476. This is the list that IBM supplied.

---

If you're using a firewall (I hope so), it's an issue of opening the correct ports on the firewall. Further, there are no pitfalls, except for security as one of the ports is the TELNET port (passwords get sent in clear text unless SSL is used. I suggest taking a look at the SSL TELNET server from IBM.

---

Nothing, it works great!

---