RE: Question on configuring soft IOC server ports

[Mark Rivers <rivers@cars.uchicago.edu>]

Hi Ralph,

Thanks for the reply.

> That way you do not need to set
> EPICS_CA_ADDR_LIST for all your other IOCs inside the beamline network
> (to have them see all the non-standard soft IOCs).

I'm not sure I understand that comment.  Why would my IOCs on the beamline network have a problem seeing the non-standard soft IOCs?  The other IOCs are just channel access clients with respect to the soft IOCs, and channel access clients on the beamline network have no problem connecting to the soft IOCs.  They just do a broadcast on the network and they find all IOCs, including soft IOCs with non-standard ports.

> - Run a CA Nameserver for all soft IOCs, and point your outside clients
> to the Nameserver. Answers to name resolution requests contain IP number
> and port, making all soft IOCs visible.

In that case the ports would still all need holes in the firewall, right?

Thanks,
Mark

-----Original Message-----
From: Ralph Lange [mailto:Ralph.Lange@gmx.de] 
Sent: Friday, September 14, 2012 4:26 PM
To: Mark Rivers
Cc: tech-talk@aps.anl.gov
Subject: Re: Question on configuring soft IOC server ports

On 14.09.2012 22:38, Mark Rivers wrote:
> I have a naïve question about configuring soft IOCs, of which we now have quite a number.  We have not been setting EPICS_CA_SERVER_PORT when running the soft IOCs, so we get the warning:
>
> cas warning: Configured TCP port was unavailable.
> cas warning: Using dynamically assigned TCP port 44160,
> cas warning: but now two or more servers share the same UDP port.
> cas warning: Depending on your IP kernel this server may not be
> cas warning: reachable with UDP unicast (a host's IP in EPICS_CA_ADDR_LIST)
>
> We have also realized that our soft IOCs are not visible from outside our beamline firewall.  We have opened up ports 5064 and 5065 in the beamline firewall, so we can access PVs from the wireless network, and that works for VME crates (and the first soft IOC on a given computer).
>
> If we want to be able to access the soft IOCs from the wireless as well, is the following sufficient:
>
> - Set each soft IOC to use a specific EPICS_CA_SERVER_PORT
> - Open those ports in the firewall

That should work.

Two other options that might be preferable:
- Run a CA Gateway on a (dedicated, maybe virtual) machine inside your
beamline net, set it to a non-standard port, and open the firewall just
for access to that machine/port. That way you do not need to set
EPICS_CA_ADDR_LIST for all your other IOCs inside the beamline network
(to have them see all the non-standard soft IOCs).
- Run a CA Nameserver for all soft IOCs, and point your outside clients
to the Nameserver. Answers to name resolution requests contain IP number
and port, making all soft IOCs visible.

~Ralph