New EE connection will not activate

Firewalls between the Enterprise Extender nodes must permit UDP traffic on all five EE ports for the IP address associated with each EE endpoint. If they do not, Enterprise Extender is not able to communicate. Figure 1 depicts a simple configuration that shows that the firewall protecting HostA is correctly configured to allow UDP traffic to pass through. The firewall guarding HostB has incorrectly left the firewall blocking UDP traffic. In this example, the firewalls are configured so that ICMP messages can pass through.

Figure 1. Enterprise Extender configuration with firewalls

SWPA2B   PU    ADDR=01,                         SWPB2A   PU   ADDR=01,                
               CPCP=YES,                                      CPCP=YES, 
               CPNAME=HOSTB,                                  CPNAME=HOSTA,
               CONNTYPE=APPN,                                 CONNTYPE=APPN,          
               NETID=NETB,                                    NETID=NETA, 
               PUTYPE=2                                       PUTYPE=2                
PATHA2B  PATH  GRPNM=GPIPA,                     PATHB2A  PATH GRPNM=GPIPB,  
               IPADDR=129.67.1.5                              IPADDR=9.67.1.1

You can use the EE connectivity test to assist you when a new EE connection will not activate. In Figure 1, the operator on HostA tries to dial a predefined switched PU to establish an EE connection to HostB. After the initial VARY ACCEPTED message, there is a pause, then an INOP occurs on the EE connection with reason XID OR LDLC COMMAND TIMEOUT. The INOP occurs in this case because the XIDs sent from HostA are not receiving responses back from HostB; the HostB firewall is discarding the XID packets. HostA will attempt to contact the partner up to the number of times specified by SRQRETRY. If no response is received for any XID, the connection fails.